ClawHub
Back to skill

Security audit

azure-transcription

Security checks for vulnerabilities and agentic risk

Overview

This is a coherent Azure transcription skill, with expected cloud processing and local transcript export risks that users should handle carefully.

Install only if you are comfortable sending the selected audio or referenced storage URLs to Azure Speech/Cognitive Services under your organization's data handling rules. Use a restricted Azure key, avoid committing credentials, and write transcripts only to approved local or encrypted storage because they may contain sensitive conversations.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (2)

Missing User Warnings

Medium
Confidence
90% confidence
Finding
The skill promotes cloud transcription but does not clearly warn that uploaded audio and resulting transcripts are sent to Azure services for processing. For enterprise meetings, calls, or other sensitive recordings, this omission can cause users to expose confidential or regulated data without informed consent.

Missing User Warnings

Medium
Confidence
89% confidence
Finding
The examples write transcript outputs to local directories without emphasizing that transcripts may contain sensitive meeting, customer, or personal data. This can lead to unintended persistence on shared workstations, developer machines, or synced folders where access controls are weaker than expected.

Static analysis

No suspicious patterns detected.