ClawHub
Back to skill

Security audit

Voice Reply

Security checks for vulnerabilities and agentic risk

Overview

The skill has a legitimate local voice-reply purpose, but its installer asks for root access and downloads then runs unverified third-party software.

Review before installing. Only run the installer on a machine where you are comfortable granting root access, and prefer a version that verifies published SHA-256 checksums or signatures, downloads as an unprivileged user, extracts in a staging directory, and avoids running downloaded binaries as root.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T08 · Insecure Dependencies

Error
Location
scripts/install.sh:52
Finding

Unverified Third-Party Binary Downloaded, Extracted, and Executed as Root

Content
View full analysis
&1 || true) ``` ### Technical Analysis The installer requires execution as root and downloads a precompiled `sherpa-onnx` archive from a GitHub release. Although the dependency version is pinned to `v1.12.23` and the source is consistent with the Skill's declared functionality, the archive is not authenticated with a pinned cryptographic digest or verified signature. HTTPS protects the transfer in transit but does not guarantee artifact integrity if the upstream repository, maintainer account, release workflow, or hosted release asset is compromised. The archive is extracted directly into `/opt/sher ...[truncated 1959 chars]
Remediation
View remediation

T08 · Insecure Dependencies

Warning
Location
scripts/install.sh:77
Finding

Unverified Voice Model Archives Extracted with Root Privileges

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (17)

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
95% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · scripts/install.sh (reported line 122)May include surrounding context.

sh
"Test" 2>&1 || true)

if [ -f "/tmp/test-voice-reply.wav" ]; then
    rm /tmp/test-voice-reply.wav
    echo -e "${GREEN}Installation successful!${NC}"
else
    echo -e "${RED}Warning: Test failed. Please check the installation.${NC}"

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
70% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · README.md (reported line 21)May include surrounding context.

bash
cd scripts
sudo ./install.sh

This installs:

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
70% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 42)May include surrounding context.

bash
cd scripts
sudo ./install.sh

This installs:

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
70% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 50)May include surrounding context.

bash
cd scripts
sudo ./install.sh

This installs:

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
70% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 53)May include surrounding context.

bash
cd scripts
sudo ./install.sh

This installs:

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
70% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 60)May include surrounding context.

bash
cd scripts
sudo ./install.sh

This installs:

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
70% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 69)May include surrounding context.

bash
cd scripts
sudo ./install.sh

This installs:

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
70% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 75)May include surrounding context.

bash
cd scripts
sudo ./install.sh

This installs:

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The README presents activation examples like "Reply with a voice message" and "Say that as audio" without clarifying whether these are the exact triggers, examples only, or what contexts should not invoke the skill. These phrases are common enough in normal chat that they could cause unintended invocation if used as trigger guidance.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
92% confidence
Finding

The skill documentation describes shell-based installation and execution but the manifest does not declare an explicit tool scope such as permissions or allowed-tools. This creates ambiguity about what command execution the skill requires and can lead to over-broad runtime authority or unsafe operator assumptions when the skill is invoked.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The usage guidance includes broad phrases like 'voice reply', 'audio response', and 'hear something read aloud', which are common requests and may cause the skill to trigger unintentionally. Unintended invocation is primarily a safety and routing issue, but in a shell-capable skill it can cause unexpected local command execution and file generation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
84% confidence
Finding

The file states 'Auto-detect Language - Automatically selects voice based on text,' which imposes a language/locale behavior automatically. The documentation does not state that users can opt in to auto-detection before it is applied, creating a potential language/locale policy issue.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
70% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 65)May include surrounding context.

md
# voice-reply skill - Installation Script
# Installs sherpa-onnx runtime and Piper voice models
#
# Usage: sudo ./install.sh [--german-only|--english-only|--all]

set -e

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
70% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · scripts/install.sh (reported line 5)May include surrounding context.

sh
# voice-reply skill - Installation Script
# Installs sherpa-onnx runtime and Piper voice models
#
# Usage: sudo ./install.sh [--german-only|--english-only|--all]

set -e

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
70% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · scripts/install.sh (reported line 20)May include surrounding context.

sh
# voice-reply skill - Installation Script
# Installs sherpa-onnx runtime and Piper voice models
#
# Usage: sudo ./install.sh [--german-only|--english-only|--all]

set -e

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
80% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · scripts/install.sh (reported line 20)May include surrounding context.

sh
# Check if running as root
if [ "$EUID" -ne 0 ]; then
    echo -e "${RED}Error: Please run as root (sudo ./install.sh)${NC}"
    exit 1
fi

External Transmission

Medium
Category
Data Exfiltration
Confidence
95% confidence
Finding

The installer, when run as root, downloads and extracts a release tarball from the internet without any integrity verification such as a pinned checksum or signature check. If the upstream release, redirect path, or transport chain is compromised, arbitrary files or binaries could be installed under /opt and later executed with trusted local context.

Content

Scanner excerpt · scripts/install.sh (reported line 64)May include surrounding context.

sh
mkdir -p "$SHERPA_DIR"
    cd "$SHERPA_DIR"
    echo "Downloading sherpa-onnx $SHERPA_VERSION..."
    curl -L -o sherpa.tar.bz2 "https://github.com/k2-fsa/sherpa-onnx/releases/download/${SHERPA_VERSION}/sherpa-onnx-${SHERPA_VERSION}-linux-x64-shared.tar.bz2"
    echo "Extracting..."
    tar -xjf sherpa.tar.bz2 --strip-components=1
    rm sherpa.tar.bz2

Static analysis

No suspicious patterns detected.