Local Whisper

• Outcome: Review
• Latest audit: Sep 10, 2026 · 11:49 PM UTC
• Version: 1.0.2

Overview

The skill broadly matches its speech-to-text purpose, but it installs persistent local software from mutable external sources and changes OpenClaw audio settings without strong verification or clear user confirmation.

Review the scripts before installing, and only run them if you are comfortable building unpinned third-party code and changing OpenClaw's audio pipeline. Prefer pinning whisper.cpp to a reviewed commit, verifying model hashes, backing up current OpenClaw audio config, and testing in a low-privilege environment before using it with real inbound voice notes.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: scripts/install_whisper_cpp.sh:13

Finding

Unpinned Upstream Source Is Built and Installed

Content

View full analysis

Vulnerability Details

File Location: scripts/install_whisper_cpp.sh, lines 13–20
Vulnerability Type: Unpinned executable dependency
Risk Level: Medium

Vulnerable Code:

bash

if [ ! -d "$REPO/.git" ]; then
  git clone https://github.com/ggerganov/whisper.cpp "$REPO"
else
  git -C "$REPO" pull --ff-only
fi

cmake -S "$REPO" -B "$BUILD" -DCMAKE_BUILD_TYPE=Release
cmake --build "$BUILD" -j"$(nproc)"

Technical Analysis

The installer clones or updates the default branch of the upstream whisper.cpp repository and immediately compiles it. It does not select an immutable commit, verify a signed release, or confirm that the checked-out revision matches an expected hash.

As a result, the effective source code and build logic can change after this Skill has been reviewed. The use of HTTPS protects the network connection but does not establish that the current upstream repository contents are the specific contents previously audited.

Build systems can execute repository-controlled CMake logic during configuration and compilation. Therefore, compromise of the upstream repository, maintainer account, or default branch could result in attacker-controlled commands running during installation. The resulting binary and libraries are subsequently copied into ~/.local/bin and ~/.local/lib.

Attack Path

1. An attacker compromises the upstream repository, a maintainer account, or the mutable default branch.
2. The attacker adds malicious source code or CMake build logic.
3. A user follows the documented installation procedure and runs scripts/install_whisper_cpp.sh.
4. The script clones or pulls the compromised revision without validating an immutable expected commit.
5. CMake processes the attacker-controlled project and the build runs with the privileges of the installing user.
6. The script installs the resulting whisper-cli binary and shared libraries under the user's ~/.local dir ...[truncated 712 chars]

Remediation

View remediation

Remediation Suggestions

• Pin whisper.cpp to a reviewed, immutable commit hash rather than building the current default branch.
• Clone without immediately trusting the checked-out branch, fetch the expected revision explicitly, and check it out in detached-HEAD mode.
• Verify that git rev-parse HEAD exactly matches the configured commit before invoking CMake.
• Prefer a cryptographically signed upstream release where available, and verify the release tag or artifact signature against a trusted maintainer key.
• Record the approved version and hash in the repository so dependency updates require an explicit review.
• Perform builds in a restricted environment with minimal credentials, filesystem access, and network access to reduce the impact of malicious build logic.
• Review upstream changes before updating the pinned revision.

T08 · Insecure Dependencies

Note

• Location: scripts/download_models.sh:8

Finding

Downloaded Model Files Are Not Integrity Verified

Content

View full analysis

Vulnerability Details

File Location: scripts/download_models.sh, lines 8–20
Vulnerability Type: Unverified mutable third-party artifacts
Risk Level: Low

Vulnerable Code:

bash

BASE_URL="https://huggingface.co/ggerganov/whisper.cpp/resolve/main"

download() {
  local name="$1"
  local out="$MODELS_DIR/ggml-$name.bin"
  local url="$BASE_URL/ggml-$name.bin"

  if [ -f "$out" ]; then
    echo "[SKIP] $out exists"
    return 0
  fi

  echo "[DL] $url -> $out"
  curl -L --fail --retry 3 --retry-delay 2 -o "$out" "$url"
}

Technical Analysis

Model files are downloaded from the mutable main revision and accepted without checking a cryptographic checksum or signature. HTTPS authenticates and encrypts the transport connection, but it does not prove that the downloaded bytes match a model version previously reviewed by the Skill author.

The response is also written directly to its final cache path. If a download is interrupted or produces unexpected content, a partial or invalid file may remain. On a subsequent run, the script only checks whether the path exists and may therefore skip downloading a valid replacement.

These model files are later parsed by native whisper.cpp code. A modified model can directly affect transcription output. If the native parser contains a vulnerability reachable through malformed model data, a malicious model could potentially trigger memory corruption or code execution, although no such parser vulnerability was established during this audit.

Attack Path

1. An attacker compromises the model-hosting account, repository, or mutable main revision.
2. The expected model is replaced with a malicious or manipulated file.
3. A user runs scripts/download_models.sh.
4. The script follows redirects and saves the supplied file without validating a hash or signature.
5. The wrapper later passes the unverified model to the native whisper-cli process. ...[truncated 676 chars]

Remediation

View remediation

Remediation Suggestions

• Replace the mutable main URL with an immutable repository revision or versioned release URL.
• Maintain trusted SHA-256 or stronger hashes for every supported model and verify each downloaded file before use.
• If upstream signatures are available, verify them using a pinned and trusted signing key.
• Download to a temporary file in the destination directory, validate its size and checksum, and atomically rename it to the final model path only after successful verification.
• Delete temporary or invalid files when downloads or validation fail.
• When an existing model is found, verify its checksum instead of treating existence alone as proof of validity.
• Restrict model names to an explicit allowlist before constructing URLs and local paths.

SkillSpector

Vulnerability Patterns

• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (5)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 94% confidence

Finding

The code is a runtime transcription helper script, not an installer or setup workflow. It expects whisper-cli and model files to already exist in user-local paths, checks only for base or small model names, converts certain audio inputs with ffmpeg, and invokes whisper-cli. This aligns with part of the declared purpose—local/offline speech-to-text for voice notes—but materially falls short of the broader description claiming installation support, model downloading, and wider model-size support. No unrelated or suspicious extra capabilities are present; the mismatch is primarily due to overstated functionality in the description.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 89% confidence

Finding

The code does perform part of the declared purpose: it installs whisper.cpp locally. However, the description specifically claims support for downloading multiple ggml model sizes and configuring OpenClaw's audio transcription pipeline for inbound voice notes. None of that functionality appears in this code chunk. The script is limited to cloning/building whisper.cpp and installing the CLI and libraries. Because important claimed capabilities are absent, the description overstates what this code actually does.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 94% confidence

Finding

The skill instructs the user to run multiple shell scripts, but the manifest does not declare any tool scope such as permissions or allowed-tools. This creates a transparency and governance gap: reviewers and automation cannot accurately understand the skill's execution capabilities, increasing the chance that shell-based actions are run without adequate scrutiny.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

This shell script creates directories, clones or updates a remote repository, builds code, installs binaries and shared libraries into ~/.local, and creates symlinks, but it provides no confirmation prompt and almost no user disclosure before making these changes. For a code file, these are safety-relevant file writes and network/subprocess operations that should have some visible warning or explanatory notice in the script.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 81% confidence

Finding

The installation steps tell users to run a script named patch_openclaw_audio.sh that modifies OpenClaw audio configuration, but the documentation does not warn that local configuration will be changed. Silent or poorly disclosed config mutation can lead to unexpected behavior, broken audio workflows, or make later malicious persistence easier to hide among 'expected' changes.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.