ClawHub
Back to skill

Security audit

voice-email

Security checks for vulnerabilities and agentic risk

Overview

This voice-email skill is mostly coherent, but it can send Gmail messages from voice transcription without a documented pre-send confirmation step and uses under-scoped credential and install guidance.

Review this before installing. Use a dedicated Gmail account and low-quota provider keys, avoid the unpinned global install path where possible, protect openclaw.json and backups, and do not use it for sensitive email unless the workflow is changed to show the parsed recipient, subject, and body and require explicit confirmation before sending.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)

T08 · Insecure Dependencies

Warning
Location
SETUP.md:37
Finding

Unpinned Global Installation of Third-Party Packages and Binaries

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
SETUP.md:69
Finding

API Credentials Stored in Plaintext OpenClaw Configuration

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
SKILL.md:90
Finding

Email Is Sent Without a Documented Pre-Send Recipient Confirmation Gate

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Rogue AgentSelf-Modification, Session Persistence
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (13)

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 8)May include surrounding context.

md
security:
  requires:
    - network
    - file_access
  credentials:
    - deepgram_api_key
    - telegram_bot_token

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 12)May include surrounding context.

md
credentials:
    - deepgram_api_key
    - telegram_bot_token
    - gmail_oauth  # via gogcli, stored in system keyring
  optional_credentials:
    - elevenlabs_api_key  # optional, for voice responses
  permissions:

Session Persistence

Medium
Category
Rogue Agent
Confidence
60% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SETUP.md (reported line 29)May include surrounding context.

md
### Recommended: Use Test Accounts

For testing, create dedicated accounts:
- **Gmail**: Create a test Gmail account for development
- **Deepgram**: Use free tier with limited quota
- **Telegram**: Use a dedicated bot token

External Transmission

Medium
Category
Data Exfiltration
Confidence
82% confidence
Finding

The setup instructs users to transmit audio content and an API-authenticated request to Deepgram, which sends potentially sensitive voice data to a third-party external service. In an accessibility-focused email skill, spoken messages may contain email addresses, subjects, body content, or other private information, so external transcription increases confidentiality and privacy risk.

Content

Scanner excerpt · SETUP.md (reported line 160)May include surrounding context.

md
export DEEPGRAM_API_KEY="YOUR_KEY"

# Test with a sample audio file
curl -X POST "https://api.deepgram.com/v1/listen" \
  -H "Authorization: Token $DEEPGRAM_API_KEY" \
  -H "Content-Type: audio/ogg" \
  --data-binary @test.ogg

External Transmission

Medium
Category
Data Exfiltration
Confidence
82% confidence
Finding

The setup instructs users to transmit audio content and an API-authenticated request to Deepgram, which sends potentially sensitive voice data to a third-party external service. In an accessibility-focused email skill, spoken messages may contain email addresses, subjects, body content, or other private information, so external transcription increases confidentiality and privacy risk.

Content

Scanner excerpt · SETUP.md (reported line 160)May include surrounding context.

md
export DEEPGRAM_API_KEY="YOUR_KEY"

# Test with a sample audio file
curl -X POST "https://api.deepgram.com/v1/listen" \
  -H "Authorization: Token $DEEPGRAM_API_KEY" \
  -H "Content-Type: audio/ogg" \
  --data-binary @test.ogg

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
70% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SETUP.md (reported line 205)May include surrounding context.

md
If voice messages fail to download:
- Check DNS: `resolvectl status`
- Try Cloudflare DNS: `sudo resolvectl dns tailscale0 1.1.1.1 1.0.0.1`
- Restart gateway: `openclaw gateway restart`

## Cost

Unrestricted Tool Access

Medium
Category
Excessive Agency
Confidence
80% confidence
Finding

Skill grants unrestricted tool access without appropriate constraints. An agent with unfettered tool access can perform arbitrary actions including file modification, network requests, and code execution.

Content

Scanner excerpt · SKILL.md (reported line 40)May include surrounding context.

md
## What This Skill CANNOT Do

- ❌ Execute arbitrary code
- ❌ Access files outside of logging/debugging
- ❌ Modify system files
- ❌ Access other accounts without explicit OAuth

Unrestricted Tool Access

Medium
Category
Excessive Agency
Confidence
80% confidence
Finding

Skill grants unrestricted tool access without appropriate constraints. An agent with unfettered tool access can perform arbitrary actions including file modification, network requests, and code execution.

Content

Scanner excerpt · SKILL.md (reported line 140)May include surrounding context.

md
## What This Skill CANNOT Do

- ❌ Execute arbitrary code
- ❌ Access files outside of logging/debugging
- ❌ Modify system files
- ❌ Access other accounts without explicit OAuth

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
60% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 42)May include surrounding context.

md
- ❌ Execute arbitrary code
- ❌ Access files outside of logging/debugging
- ❌ Modify system files
- ❌ Access other accounts without explicit OAuth
- ❌ Send emails to unknown recipients without user confirmation

Session Persistence

Medium
Category
Rogue Agent
Confidence
60% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 144)May include surrounding context.

md
## Best Practices for Production

1. **Use test accounts**: Create dedicated Gmail account for testing
2. **Limit Gmail OAuth**: Use app-specific passwords if needed
3. **Scope Deepgram**: Use minimal quota for testing
4. **Review logs**: Check `/tmp/openclaw-*.log` for unexpected activity

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 164)May include surrounding context.

  1. Test Deepgram directly:
bash
curl -X POST "https://api.deepgram.com/v1/listen" \
  -H "Authorization: Token $DEEPGRAM_API_KEY" \
  -H "Content-Type: audio/ogg" \
  --data-binary @sample.ogg

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 164)May include surrounding context.

  1. Test Deepgram directly:
bash
curl -X POST "https://api.deepgram.com/v1/listen" \
  -H "Authorization: Token $DEEPGRAM_API_KEY" \
  -H "Content-Type: audio/ogg" \
  --data-binary @sample.ogg

Description-Behavior Mismatch

Low
Category
Not specified by scanner
Confidence
76% confidence
Finding

The manifest describes a voice-email accessibility skill, and most documented behavior aligns with that purpose. However, the setup guide states the skill requires access to Telegram, introducing a messaging-platform dependency that is not reflected in the manifest description.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.