ClawHub
Back to skill

Security audit

Local Transcription

Security checks for vulnerabilities and agentic risk

Overview

The skill mostly matches local transcription, but it also exposes broader AI service examples and asks users to install and run unpinned packages, so it should be reviewed before use.

Install only if you trust the `ollama-herd` and `mlx-qwen3-asr` package sources, are comfortable running a local router and node service, and understand that the documented router also exposes LLM, image, and embeddings endpoints beyond transcription. Prefer pinned versions, an isolated environment, and a localhost-only or otherwise intentionally scoped network configuration.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:29
Finding

Unpinned Third-Party Packages Are Installed and Immediately Executed

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 29-31
Vulnerability Type: Unpinned and unverified third-party dependencies
Risk Level: Medium

Vulnerable Code

bash
pip install ollama-herd
herd                                    # start the transcription router (port 11435)
herd-node                               # start on each transcription device
uv tool install "mlx-qwen3-asr[serve]" --python 3.14  # install speech-to-text model

Technical Analysis

The setup instructions install the latest available versions of ollama-herd, mlx-qwen3-asr, and their transitive dependencies without version constraints, package hashes, a lock file, or signature verification. The instructions then immediately execute the installed herd and herd-node entry points.

Package installation can execute package build or installation logic, while the installed entry points execute package-controlled code directly. Consequently, the effective code run by users may change after this skill has been reviewed. A compromised package release, compromised maintainer account, or malicious transitive dependency could therefore introduce arbitrary code.

The documented package and repository names are consistent with the skill's declared functionality, and the audit found no evidence that the named packages are intentionally malicious. This finding concerns the unsafe dependency acquisition and execution model rather than a confirmed malicious payload.

Attack Path

  1. An attacker compromises a named package, one of its transitive dependencies, or the relevant package-publishing account.
  2. The attacker publishes a malicious release that still satisfies the unconstrained installation commands.
  3. A user follows the instructions and runs pip install ollama-herd or the unpinned uv tool install command.
  4. The package manager retrieves and installs the attacker-controlled release.
  5. Malicious code may execute during installation or when the use ...[truncated 787 chars]
Remediation
View remediation

Remediation Suggestions

  1. Pin every directly installed package to a reviewed, exact version, for example ollama-herd==X.Y.Z.
  2. Pin transitive dependencies through a reviewed lock file or constraints file.
  3. Require cryptographic package hashes where supported, such as a hash-locked requirements file installed with pip --require-hashes.
  4. Publish and verify expected package provenance, repository ownership, release signatures, and checksums.
  5. Install packages inside an isolated virtual environment or dedicated uv environment rather than the user's global Python environment.
  6. Separate installation from execution so users can inspect the resolved dependency set before launching herd or herd-node.
  7. Recommend running the router and worker with a dedicated, non-administrative account that has access only to required audio and application directories.
  8. Document the network interfaces on which the service listens and default to loopback unless fleet access is explicitly required.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (11)

External Script Fetching

High
Category
Supply Chain
Confidence
90% confidence
Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · SKILL.md (reported line 40)May include surrounding context.

Transcribe audio with speech-to-text

curl — basic transcription

bash
# Speech-to-text transcription of a meeting recording

External Script Fetching

High
Category
Supply Chain
Confidence
90% confidence
Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · SKILL.md (reported line 129)May include surrounding context.

LLM inference

bash
curl http://localhost:11435/v1/chat/completions \
  -H "Content-Type: application/json" \
  -d '{"model":"gpt-oss:120b","messages":[{"role":"user","content":"Hello"}]}'

External Script Fetching

High
Category
Supply Chain
Confidence
90% confidence
Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · SKILL.md (reported line 156)May include surrounding context.

curl -s http://localhost:11435/dashboard/api/transcription-stats | python3 -m json.tool

Fleet health (includes speech-to-text transcription activity)

curl -s http://localhost:11435/dashboard/api/health | python3 -m json.tool

text

Dashboard at `http://localhost:11435/dashboard` — speech-to-text transcription queues show with [STT] badge alongside LLM and image queues.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 31)May include surrounding context.

Enable speech-to-text transcription:

bash
curl -X POST http://localhost:11435/dashboard/api/settings \
  -H "Content-Type: application/json" \
  -d '{"transcription": true}'

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 56)May include surrounding context.

md
def speech_to_text_transcription(audio_path):
    """Run speech-to-text transcription on an audio file."""
    with open(audio_path, "rb") as f:
        transcription_resp = httpx.post(
            "http://localhost:11435/api/transcribe",
            files={"audio": (audio_path, f)},
            timeout=300.0,

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 76)May include surrounding context.

md
def speech_to_text_transcription(audio_path):
    """Run speech-to-text transcription on an audio file."""
    with open(audio_path, "rb") as f:
        transcription_resp = httpx.post(
            "http://localhost:11435/api/transcribe",
            files={"audio": (audio_path, f)},
            timeout=300.0,

Internal Network Request

Medium
Category
Server-Side Request Forgery
Confidence
70% confidence
Finding

Code issues a request to a loopback, link-local, or private-range host. This can reach internal services not meant to be exposed and is a common SSRF pivot.

Content

Scanner excerpt · SKILL.md (reported line 56)May include surrounding context.

md
def speech_to_text_transcription(audio_path):
    """Run speech-to-text transcription on an audio file."""
    with open(audio_path, "rb") as f:
        transcription_resp = httpx.post(
            "http://localhost:11435/api/transcribe",
            files={"audio": (audio_path, f)},
            timeout=300.0,

Internal Network Request

Medium
Category
Server-Side Request Forgery
Confidence
70% confidence
Finding

Code issues a request to a loopback, link-local, or private-range host. This can reach internal services not meant to be exposed and is a common SSRF pivot.

Content

Scanner excerpt · SKILL.md (reported line 76)May include surrounding context.

md
def speech_to_text_transcription(audio_path):
    """Run speech-to-text transcription on an audio file."""
    with open(audio_path, "rb") as f:
        transcription_resp = httpx.post(
            "http://localhost:11435/api/transcribe",
            files={"audio": (audio_path, f)},
            timeout=300.0,

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The skill is advertised as a local transcription helper, but it also documents LLM, image generation, and embeddings endpoints exposed through the same router. This materially expands the skill's operational scope and attack surface beyond the stated purpose, making it easier for an agent or user to invoke unrelated powerful services without clear consent or boundary checks.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

Exposing unrelated AI capabilities in a narrowly scoped transcription skill violates least privilege and creates a deceptive interface boundary. Even if the services are local, an agent consuming this skill could be induced to access broader functionality than the user intended, including generation and inference endpoints with different risk profiles.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
80% confidence
Finding

Within a transcription skill, documenting a chat-completions endpoint on the same router introduces an unrelated network-accessible capability that could be invoked under the guise of transcription. The issue is not the localhost call alone, but the inclusion of broader service endpoints that can alter agent behavior and expand accessible functionality unexpectedly.

Content

Scanner excerpt · SKILL.md (reported line 129)May include surrounding context.

LLM inference

bash
curl http://localhost:11435/v1/chat/completions \
  -H "Content-Type: application/json" \
  -d '{"model":"gpt-oss:120b","messages":[{"role":"user","content":"Hello"}]}'