ClawHub
Back to skill

Security audit

Quicklrc Transcribe

Security checks for vulnerabilities and agentic risk

Overview

This is a straightforward QuickLRC API helper; the main risk is that submitted media URLs and optional lyrics are sent to QuickLRC and successful requests may spend credits.

Install only if you are comfortable using a QuickLRC API key, sending selected media URLs and any provided lyrics to QuickLRC for processing, and spending QuickLRC credits on successful requests. Avoid private, sensitive, regulated, or unauthorized copyrighted material unless you have permission and have reviewed QuickLRC's terms.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

Missing User Warnings

Medium
Confidence
91% confidence
Finding
The skill explicitly instructs users to send audio/video URLs and optional lyrics to a third-party API, but it does not warn that potentially sensitive media references and text content will be transmitted off-platform. This creates a real privacy and data-handling risk because users may unknowingly submit private URLs, copyrighted material, or confidential lyrics/transcripts to an external service.

Static analysis

No suspicious patterns detected.