ClawHub
Back to skill

Security audit

mimo-asr

Security checks across malware telemetry and agentic risk

Overview

This skill does the advertised speech-to-text job, but it uploads audio to a cloud service while disabling HTTPS certificate verification.

Install only if you are comfortable sending audio to the stated Hugging Face/Gradio service. Avoid confidential, regulated, or highly personal recordings unless HTTPS certificate verification is fixed and you understand the remote service's privacy and retention behavior.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Lp3

Medium
Category
MCP Least Privilege
Confidence
87% confidence
Finding
The skill documentation indicates concrete network access to a third-party Gradio endpoint and optional file output behavior, but it declares no corresponding permissions. Undeclared capabilities are dangerous because they prevent meaningful user review and policy enforcement, especially here where user audio may be transmitted off-device to a cloud service and transcripts may be written locally.

Missing User Warnings

Medium
Confidence
84% confidence
Finding
The skill explicitly sends user-provided audio to a third-party remote ASR service, but the script provides only generic progress messages and no clear privacy or data-transfer warning at runtime. This is dangerous because users may unknowingly upload sensitive speech content, credentials, or personal data to an external service with separate retention and processing policies.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

Detected: suspicious.insecure_tls_verification

HTTPS certificate verification is disabled.

Warn
Code
suspicious.insecure_tls_verification
Location
scripts/mimo_asr_api.py:30