ClawHub
Back to skill

Security audit

Azure Ai Transcription Py Free

Security checks across malware telemetry and agentic risk

Overview

This is a straightforward Azure speech-to-text helper, with sensitive cloud audio and credential handling that users should manage carefully.

Install only if you intend to use Azure Speech transcription. Treat TRANSCRIPTION_KEY values and SAS URLs as secrets, prefer short-lived read-only SAS tokens, avoid regulated or confidential recordings unless authorized, and verify the PyPI package source before installation.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (3)

Vague Triggers

Medium
Confidence
84% confidence
Finding
The activation/invocation language is overly broad and could cause an agent to apply this skill outside its intended domain whenever a user asks for generic execution or processing. In an agent environment with exec capability and access to credentials, vague trigger boundaries increase the chance of unintended tool use, accidental data transmission, or execution on unrelated requests.

Vague Triggers

Medium
Confidence
90% confidence
Finding
The generic capability sections describe broad instruction parsing, data processing, and result validation unrelated to transcription-specific behavior. In a tool-using agent, this can over-expand the skill's match surface and make the agent invoke a skill with exec permission for arbitrary tasks, increasing the risk of unintended command execution or mishandling sensitive data.

Missing User Warnings

Medium
Confidence
87% confidence
Finding
The skill instructs users to send audio URLs and resulting transcription content to Azure but does not provide a clear, prominent disclosure that user audio and derived text leave the local environment and are processed by a third-party cloud service. This can lead to inadvertent transmission of sensitive recordings, SAS-bearing URLs, or regulated data without informed consent.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.