ClawHub
Back to skill

Security audit

Azure语音转写专业版

Security checks across malware telemetry and agentic risk

Overview

The skill is mostly a disclosed Azure transcription helper, but its trigger scope is mismatched and it handles sensitive audio/transcripts without clear user-control guidance.

Review before installing. Use this only for explicit speech-to-text transcription tasks, avoid relying on the translation/localization trigger, and make sure any audio sent to Azure and any transcript files written locally are approved for that environment. Provide output paths deliberately and protect transcripts that may include confidential calls, meetings, or personal data.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (3)

Vague Triggers

High
Confidence
80% confidence
Finding
A vague and mismatched trigger condition can cause the agent to invoke this skill for unrelated translation/localization requests, increasing the chance that sensitive user text or files are sent to external transcription workflows unexpectedly. In an agent context with exec/read/write and networked cloud APIs, unintended invocation materially raises privacy and operational risk.

Missing User Warnings

Medium
Confidence
78% confidence
Finding
The skill instructs exporting transcripts to local disk without prominently warning that potentially sensitive speech content will be persisted as files. In shared workspaces or agent environments, silent persistence can expose confidential meeting, call-center, or personal data to other users, processes, or backups.

Missing User Warnings

Medium
Confidence
89% confidence
Finding
The skill sends audio and optional callback data to external Azure/network endpoints but does not present a prominent privacy or data-handling warning. Because audio may contain highly sensitive content and callback URLs may leak metadata or results to third parties, users could unknowingly exfiltrate regulated or confidential information.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.