ClawHub
Back to skill

Security audit

AssemblyAI Transcriber

Security checks across malware telemetry and agentic risk

Overview

This skill does what it claims by sending user-chosen audio to AssemblyAI for transcription, but users should understand that audio leaves their machine.

Install only if you are comfortable sending the specific audio files or audio URLs you choose to AssemblyAI under your API key. Avoid confidential, regulated, or third-party recordings unless you have permission and have reviewed AssemblyAI privacy, retention, compliance, and billing terms. Confirm the exact file path before asking an agent to run the script, and store the API key in an environment variable or a protected local config file.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (4)

Missing User Warnings

Medium
Confidence
91% confidence
Finding
The README encourages transcription of audio files and Telegram voice messages through AssemblyAI but does not clearly disclose that the audio will be transmitted to third-party services, which may expose sensitive personal, business, or regulated content. In a transcription skill, users may reasonably submit meetings, interviews, or voice notes containing confidential data, so missing privacy and data-handling warnings increases the risk of unintended disclosure.

Missing User Warnings

Medium
Confidence
93% confidence
Finding
The skill description does not clearly warn users that uploaded audio and associated metadata are transmitted to AssemblyAI, a third-party service. This can lead to unintentional disclosure of sensitive conversations, voices, speaker identities, timestamps, and file/URL metadata, especially in meetings, interviews, or private recordings.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The script uploads local audio files or submits audio URLs to AssemblyAI, but it provides no explicit privacy notice, consent prompt, or warning that potentially sensitive voice data will be sent to a third-party service. In a transcription skill used for meetings, interviews, and voice messages, this can expose confidential or regulated content without the operator fully realizing the data-sharing implications.

External Transmission

Medium
Category
Data Exfiltration
Content
Path(__file__).parent.parent.parent.parent / ".assemblyai_config.json",
]

BASE_URL = "https://api.assemblyai.com/v2"


def load_api_key():
Confidence
93% confidence
Finding
https://api.assemblyai.com/

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.