ClawHub

Mic Recorder

Security checks across malware telemetry and agentic risk

Overview

This skill appears to do what it says, but it handles microphone recordings and sends them to Feishu without enough consent, review, or data-handling guardrails.

Review carefully before installing. Use only when all recorded parties know and consent, verify the Feishu destination before sending, inspect recordings before upload, and define how local and Feishu copies will be retained or deleted.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (3)

Missing User Warnings

Medium
Confidence
91% confidence
Finding
The skill explicitly enables microphone recording and transmission of captured audio to Feishu, including background sound, but does not present a clear privacy warning, consent requirement, or guidance to confirm that all affected parties are aware of the recording. This is dangerous because microphone capture can collect sensitive conversations and ambient data, and the omission makes accidental or non-consensual collection more likely.

Ssd 3

High
Confidence
97% confidence
Finding
The skill’s stated purpose is to record microphone audio, including background sound, and send it to Feishu. In context, this creates a direct workflow for collecting and transmitting potentially sensitive audio, which can include private conversations, bystander speech, or confidential ambient information if used without strong consent and disclosure controls.

Ssd 3

High
Confidence
96% confidence
Finding
The examples show a straightforward path to automatically deliver recorded audio files to Feishu after copying them into the workspace. This is dangerous because it operationalizes exfiltration of microphone-captured content with minimal friction, increasing the chance that sensitive recordings are shared externally without adequate review, consent, or data classification.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal