Groq Voice Transcribe

• Outcome: Review
• Latest audit: Sep 11, 2026 · 12:13 PM UTC
• Version: 1.0.1

Overview

The skill has a clear transcription purpose, but a script bug can send unintended local files to Groq if unsafe flag values are passed.

Review before installing. Use only trusted audio paths and trusted prompt/model/language values, avoid passing values that begin with @, and prefer fixing the script to use --form-string for non-file fields plus validation before use. Store the Groq API key through the safest available credential mechanism and rotate it if it may have been exposed.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/transcribe.sh:73

Finding

User-Controlled Multipart Fields Permit Unintended Local File Disclosure

Content

View full analysis

Vulnerability Details

File Location: scripts/transcribe.sh, lines 73-82
Vulnerability Type: Unsafe use of user-controlled values in curl multipart form fields
Risk Level: High

bash

curl -sS https://api.groq.com/openai/v1/audio/transcriptions \
  -H "Authorization: Bearer $GROQ_API_KEY" \
  -H "Accept: application/json" \
  -F "file=@${in}" \
  -F "model=${model}" \
  -F "response_format=${response_format}" \
  ${language:+-F "language=${language}"} \
  ${prompt:+-F "prompt=${prompt}"} \
  >"$out"

Technical Analysis

The model, language, and prompt values are supplied through command-line arguments and passed to curl using -F. Curl assigns special meaning to multipart values beginning with @: it treats the remainder of the value as a local filename and reads that file into the request body.

Shell quoting alone does not disable curl's multipart-file interpretation. Consequently, a value such as --prompt @/etc/passwd produces a form field equivalent to prompt=@/etc/passwd, causing curl to read and transmit that local file.

The optional language and prompt expansions are also not constructed through a Bash argument array. This makes argument boundaries less robust for values containing whitespace or shell glob characters. The primary confirmed issue, however, is curl's interpretation of attacker-controlled multipart values as local file references.

Attack Path

1. An attacker or untrusted caller gains control over arguments passed to transcribe.sh.
2. The caller supplies an existing audio file and a malicious form value, for example:

   bash

   GROQ_API_KEY="configured-key" ./scripts/transcribe.sh audio.ogg \
     --prompt '@/path/to/sensitive-file'
   

3. The script validates only the audio input and the presence of GROQ_API_KEY; it does not reject the leading @ in the prompt.
4. The prompt is passed to curl through -F.
5. Curl interprets `@ ...[truncated 942 chars]

Remediation

View remediation

Remediation Suggestions

Use --form-string for every non-file multipart field so curl always treats the supplied value as literal text. Construct curl arguments with a Bash array to preserve exact argument boundaries and avoid word splitting or pathname expansion.

bash

curl_args=(
  -sS
  "https://api.groq.com/openai/v1/audio/transcriptions"
  -H "Authorization: Bearer $GROQ_API_KEY"
  -H "Accept: application/json"
  -F "file=@${in}"
  --form-string "model=${model}"
  --form-string "response_format=${response_format}"
)

if [[ -n "$language" ]]; then
  curl_args+=(--form-string "language=${language}")
fi

if [[ -n "$prompt" ]]; then
  curl_args+=(--form-string "prompt=${prompt}")
fi

curl "${curl_args[@]}" >"$out"

Apply additional defense in depth:

• Validate model against an explicit allowlist of supported Groq model identifiers.
• Validate language against the expected language-code syntax.
• Define reasonable length limits for prompt, model, and language.
• Keep -F "file=@${in}" only for the intentionally uploaded audio file.
• Add regression tests using values beginning with @, containing spaces, and containing glob characters to verify that they remain literal form-field text.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Rogue Agent: Self-Modification, Session Persistence
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (3)

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 94% confidence

Finding

The skill documents shell execution via {baseDir}/scripts/transcribe.sh but does not declare any tool scope, permissions, or allowed-tools boundary. This creates a capability mismatch where an agent may invoke shell functionality without explicit scoping, increasing the risk of unintended command execution or unsafe composition with user-controlled arguments.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 84% confidence

Finding

The skill instructs users to provide their Groq API key to the assistant and says the assistant can store it in ~/.openclaw/openclaw.json, which encourages secret disclosure to the agent and persistence on disk. If the assistant, logs, memory, or local configuration are exposed, the API key can be recovered and abused for unauthorized API usage.

Content

Scanner excerpt · SKILL.md (reported line 24)May include surrounding context.

md

Get one from:

- https://console.groq.com/
- Sign in, open **API Keys**, then create a key

## Easiest setup in OpenClaw

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/transcribe.sh (reported line 75)May include surrounding context.

sh

mkdir -p "$(dirname "$out")"

curl -sS https://api.groq.com/openai/v1/audio/transcriptions \
  -H "Authorization: Bearer $GROQ_API_KEY" \
  -H "Accept: application/json" \
  -F "file=@${in}" \

Static analysis

No suspicious patterns detected.