ClawHub
Back to skill

Security audit

Whisper ASR — Speech-to-Text

Security checks across malware telemetry and agentic risk

Overview

This speech-to-text skill appears aligned with its purpose, but its default path can run downloaded model code without clearly warning the user.

Install only if you are comfortable with first-run model downloads and the default FunASR engine trusting downloaded model code. Use an isolated Python environment, consider pinning or reviewing the ModelScope model and dependencies, and remove or adjust the hard-coded /home/vincent path before use.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

Missing User Warnings

Low
Confidence
75% confidence
Finding
Omitting an upfront warning about first-run model downloads and local filesystem writes can surprise users in restricted or privacy-sensitive environments. While common for ML tools, undisclosed network retrieval and cache creation may violate user expectations, policy controls, or operational assumptions about fully local execution.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.