ClawHub
Back to skill

Security audit

Llm Provider Whisper Tool Free

Security checks across malware telemetry and agentic risk

Overview

This skill is a local Whisper transcription guide whose network downloads and setup commands are disclosed and aligned with its stated purpose.

Before installing, review the dependency commands yourself, especially any sudo or system package-manager command. Expect the first transcription run to download a Whisper model from Hugging Face into ~/.cache/whisper; use a manually preloaded model if you need a strictly offline environment.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (4)

Missing User Warnings

Medium
Confidence
85% confidence
Finding
The skill emphasizes local/offline use but does not prominently warn that first execution automatically downloads models from the network. This can violate user expectations in restricted or privacy-sensitive environments and may cause unapproved external network access.

Sudo/Root Execution

Medium
Category
Privilege Escalation
Content
brew install ffmpeg

# Ubuntu / Debian
sudo apt update && sudo apt install ffmpeg

# Windows(推荐使用 scoop 或 choco)
scoop install ffmpeg
Confidence
88% confidence
Finding
sudo

Sudo/Root Execution

Medium
Category
Privilege Escalation
Content
brew install ffmpeg

# Ubuntu / Debian
sudo apt update && sudo apt install ffmpeg

# Windows(推荐使用 scoop 或 choco)
scoop install ffmpeg
Confidence
88% confidence
Finding
sudo

Chaining Abuse

High
Category
Tool Misuse
Content
brew install ffmpeg

# Ubuntu / Debian
sudo apt update && sudo apt install ffmpeg

# Windows(推荐使用 scoop 或 choco)
scoop install ffmpeg
Confidence
82% confidence
Finding
&& sudo

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.