ClawHub
Back to skill

Security audit

Whisper Voice Transcription (whisper.cpp)

Security checks for vulnerabilities and agentic risk

Overview

This skill is a coherent local transcription guide with disclosed optional cloud fallback, but users should harden its temporary-file and dependency-pinning steps.

Installers should be comfortable building third-party code locally. Prefer pinning whisper.cpp to a known release or commit, verify model downloads when possible, and replace /tmp/voice.wav with a unique private temporary file that is removed after transcription. Use the cloud fallback only when you accept that the audio will leave the machine.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T09 · Insecure Skill Coding Practices

Warning
Location
SKILL.md:31
Finding

Predictable Shared Temporary File Exposes Audio and Enables File Clobbering

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, line 31
Vulnerability Type: Predictable temporary-file usage
Risk Level: Medium

Vulnerable Code:

bash
ffmpeg -y -i input_audio.ogg -ar 16000 -ac 1 -f wav /tmp/voice.wav

Technical Analysis

The transcription workflow writes audio to the fixed path /tmp/voice.wav. Because /tmp is commonly shared by multiple local users and processes, the predictable filename creates race-condition and symbolic-link risks. The -y option directs FFmpeg to overwrite an existing destination without confirmation.

A local attacker may pre-create /tmp/voice.wav as a symbolic link to another file. If the user running FFmpeg has permission to modify the linked target, FFmpeg may overwrite that target. Concurrent transcription processes may also overwrite or consume one another's audio. Furthermore, the instructions do not remove the temporary file after transcription, potentially leaving sensitive voice data accessible beyond its intended lifetime.

Attack Path

  1. A local attacker predicts that the documented workflow will use /tmp/voice.wav.
  2. Before the workflow starts, the attacker creates a symbolic link or competing file at that path.
  3. The operator executes the documented FFmpeg command.
  4. Because -y permits unconditional replacement, FFmpeg writes through the prepared path where operating-system permissions allow it.
  5. A linked target may be corrupted, or attacker-controlled audio may be substituted and subsequently transcribed.
  6. If no attacker intervenes, the generated audio may nevertheless remain in /tmp and expose sensitive speech to other processes or users where local permissions permit access.

Impact Assessment

Exploitation does not independently grant elevated privileges; its effect is bounded by the filesystem permissions of the user executing FFmpeg. Within those permissions, it may enable unintended file replacement, workf ...[truncated 198 chars]

Remediation
View remediation

Remediation Suggestions

  • Create a unique, private temporary directory with mktemp -d rather than using a fixed shared filename.
  • Apply restrictive permissions with umask 077.
  • Register a shell cleanup trap so temporary audio is removed on successful completion, failure, or interruption.
  • Ensure the destination is newly created and cannot be resolved through an existing symbolic link.
  • Quote all paths to prevent parsing problems.

Example hardened workflow:

bash
umask 077
tmpdir="$(mktemp -d)" || exit 1
trap 'rm -rf -- "$tmpdir"' EXIT HUP INT TERM

voice_file="$tmpdir/voice.wav"
ffmpeg -nostdin -i input_audio.ogg -ar 16000 -ac 1 -f wav "$voice_file" &&
  ~/whisper.cpp/build/bin/whisper-cli \
    -m ~/whisper.cpp/models/ggml-large-v3.bin \
    -f "$voice_file" \
    -l auto \
    --no-timestamps

T08 · Insecure Dependencies

Note
Location
SKILL.md:22
Finding

Unpinned whisper.cpp Source Is Downloaded and Compiled

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 22–24
Vulnerability Type: Unpinned third-party source dependency
Risk Level: Low

Vulnerable Code:

bash
git clone --depth 1 https://github.com/ggerganov/whisper.cpp.git ~/whisper.cpp
cd ~/whisper.cpp
cmake -B build -DCMAKE_BUILD_TYPE=Release

Technical Analysis

The instructions clone the current default branch of the official whisper.cpp repository and immediately configure it for compilation. They do not pin a reviewed release tag or immutable commit hash. Therefore, the source code and build behavior can change after this Skill has been audited.

Although the repository URL is the expected official source, relying on a mutable branch weakens build reproducibility and supply-chain integrity. A compromised upstream repository or account, or an unintended upstream change, could cause future users to download and compile code that was not part of the reviewed version. The separate recommendation to verify hashes “when possible” does not supply a mandatory expected digest for the source or models.

Attack Path

  1. The upstream default branch changes, or an attacker compromises the upstream repository or an authorized maintainer account.
  2. Malicious or otherwise unsafe source code or build logic is added to the branch.
  3. A user follows the Skill and clones the current branch without validating an immutable revision.
  4. CMake configures and compiles the newly retrieved source.
  5. The altered behavior executes during the build or when the resulting transcription binary is run.

Impact Assessment

Any malicious behavior would execute with the privileges of the user performing the build or running the compiled binary. Within that user's access scope, a compromised dependency could read or modify files, access transcription inputs and outputs, or initiate network activity. The practical likelihood is reduced because the documented rep ...[truncated 144 chars]

Remediation
View remediation

Remediation Suggestions

  • Pin whisper.cpp to a reviewed release and immutable commit hash rather than cloning the current default branch.
  • Fetch the required revision explicitly and verify that HEAD matches the documented commit before building.
  • Prefer a signed release tag and verify its signature against a trusted maintainer key.
  • Publish expected SHA-256 digests for downloaded model files and require verification before use.
  • Periodically review and deliberately update the pinned version rather than receiving upstream changes implicitly.

Example pattern:

bash
repo="$HOME/whisper.cpp"
expected_commit="REPLACE_WITH_REVIEWED_FULL_COMMIT_HASH"

git clone --filter=blob:none https://github.com/ggerganov/whisper.cpp.git "$repo"
cd "$repo"
git checkout --detach "$expected_commit"
test "$(git rev-parse HEAD)" = "$expected_commit" || exit 1

cmake -B build -DCMAKE_BUILD_TYPE=Release
cmake --build build -j4

Replace the placeholder with a full, independently reviewed commit hash and document the corresponding release and verification source.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep