ClawHub
Back to skill

Security audit

Llm Provider Whisper V1 Tool Free

Security checks across malware telemetry and agentic risk

Overview

This is a local Whisper transcription helper with expected command-line setup and model caching, though its documentation has some scope and API-key inconsistencies.

Install only if you are comfortable running local shell commands and installing the listed dependencies. Expect the first run to download model files and cache them locally, and use the skill for user-selected audio/video transcription or audio-to-English translation, not general text localization. Clarify the contradictory API-key note with the publisher if operating in a controlled or offline environment.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (3)

Intent-Code Divergence

Medium
Confidence
96% confidence
Finding
The skill contains contradictory security-relevant guidance: one section states the tool is fully local and requires no API key, while the known limitations say an API key is required. This can mislead users about network exposure, credential requirements, and deployment assumptions, causing unsafe configuration decisions or accidental disclosure of secrets.

Vague Triggers

Medium
Confidence
84% confidence
Finding
The trigger condition is broader than the actual capability of the skill, stating it should be used for general text translation, multilingual conversion, and localization. That mismatch can cause the agent to invoke this skill in contexts it cannot safely or correctly handle, increasing the chance of unintended command execution or user confusion about the tool's scope.

Missing User Warnings

Medium
Confidence
89% confidence
Finding
The skill says it is local and requires no API key, but it does not prominently warn that first use downloads model files over the network and stores them on disk. Users may incorrectly assume fully offline behavior from the start, which matters in restricted environments and can create unapproved outbound network access or local persistence of downloaded artifacts.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.