ClawHub
Back to skill

Security audit

Burmese Audio Understanding

Security checks across malware telemetry and agentic risk

Overview

This skill transparently sends a user-selected Burmese audio file to Google Gemini for transcription and shows no hidden or destructive behavior.

Install only if you are comfortable sending selected audio recordings to Google Gemini for transcription. Use a scoped Gemini API key, avoid confidential or regulated recordings unless Google's handling terms fit your needs, and be aware that failed runs may not delete the uploaded remote file automatically.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

Missing User Warnings

Medium
Confidence
94% confidence
Finding
The script uploads the provided audio file to Google's external File API, which can expose potentially sensitive voice data to a third party without any disclosure, consent flow, or local-only alternative. In an audio transcription skill, users may reasonably provide private recordings, so silent exfiltration to a remote service creates a real privacy and compliance risk even if it is necessary for the feature to work.

VirusTotal

No VirusTotal findings

View on VirusTotal

Static analysis

No suspicious patterns detected.