ClawHub
Back to skill

Security audit

audio-quality-check

Security checks across malware telemetry and agentic risk

Overview

This is a local audio-quality analysis skill that processes user-selected recordings, with privacy cautions around printed recording metadata and temporary decoded audio files.

Install only if you are comfortable running local Python and ffmpeg tools on recordings you choose. Point it only at recording directories you intend to analyze, avoid using it on highly sensitive calls in shared terminals, and check temp storage after interrupted runs if decoded audio copies would matter. It should not need credentials, network access, payment authority, or crypto/account permissions.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (3)

Lp3

Medium
Category
MCP Least Privilege
Confidence
92% confidence
Finding
The skill instructs the agent to run Python scripts and shell tools like ffmpeg/ffprobe against user-supplied paths, but it declares no permissions. That mismatch is a real security issue because it hides file-read and command-execution capabilities from the permission model and review process, increasing the chance of unintended local file access or unsafe command use.

Vague Triggers

Medium
Confidence
81% confidence
Finding
The description contains many broad trigger phrases such as 'analyze audio', 'sound quality', and 'check recording', which could cause the skill to activate in contexts broader than intended. In a skill that can read local files and invoke shell tooling, accidental invocation increases exposure by prompting users or the agent toward unnecessary file access and command execution.

Missing User Warnings

Low
Confidence
76% confidence
Finding
The script prints metadata fields such as title, app name, creation time, and especially speaker names directly to stdout without any masking or consent prompt. In a recording-analysis context, this can expose sensitive personal information to terminal logs, shared consoles, CI output, or other observers, making the skill context slightly more sensitive because call recordings commonly contain private identities.

VirusTotal

49/49 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.