mlx-whisper

• Outcome: Review
• Latest audit: Sep 11, 2026 · 3:29 PM UTC
• Version: 1.0.7

Overview

This skill is for local voice transcription, but it enables automatic processing of private messaging audio with incomplete privacy, retention, and dependency controls.

Before installing, confirm you are comfortable with OpenClaw automatically downloading and transcribing voice notes from Telegram or WhatsApp and passing transcripts into the agent. Prefer a pinned, isolated mlx-whisper install, verify the missing wrapper script before use, and review where OpenClaw stores downloaded media and transcripts so you can delete or disable them if needed.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:18

Finding

Unpinned Third-Party Package Installation

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 18–22
Vulnerability Type: Unpinned and mutable third-party dependency installation
Risk Level: Medium

Vulnerable Code

json

{
  "id": "pip-mlx-whisper",
  "kind": "exec",
  "command": "pip3",
  "args": ["install", "mlx-whisper"],
  "label": "Install mlx-whisper (Apple Silicon)",
}

The same unpinned installation command is repeated at SKILL.md:45:

bash

pip3 install mlx-whisper

Technical Analysis

The Skill directs pip3 to install mlx-whisper without specifying a reviewed version, locking its transitive dependencies, or validating package integrity with cryptographic hashes. Consequently, installation resolves whatever package versions the configured Python package index serves at execution time.

This makes the installed code mutable after the Skill has been reviewed. If the upstream package, one of its dependencies, its maintainer account, or the package-index delivery path is compromised, a malicious release could execute code during installation or later when the package is imported for transcription. The global or user-level pip3 invocation also lacks explicit environment isolation, increasing the possibility of dependency conflicts and expanding the effect on the user's Python environment.

Attack Path

1. An attacker compromises the mlx-whisper distribution, a transitive dependency, or an associated package-maintainer account.
2. The attacker publishes a malicious version that remains compatible with the unrestricted package requirement.
3. A user installs the Skill or follows its setup instructions.
4. The command pip3 install mlx-whisper resolves and downloads the malicious release because no approved version or hash is enforced.
5. Malicious package code executes during installation or when OpenClaw invokes the transcription workflow.
6. The payload gains the permissions of the account runni ...[truncated 763 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin mlx-whisper to a specific version that has been reviewed, for example:

   bash

   python3 -m pip install "mlx-whisper==<reviewed-version>"
   

2. Generate a lock file containing exact versions for all transitive dependencies.
3. Require cryptographic hashes during installation, such as with a hash-pinned requirements file and:

   bash

   python3 -m pip install --require-hashes -r requirements.txt
   

4. Install the package in a dedicated virtual environment rather than the user's shared Python environment.
5. Use a trusted package index and document the expected package publisher and artifact hashes.
6. Add automated dependency monitoring and repeat the security review before updating any pinned version or hash.
7. Include the referenced bin/mlx-whisper-transcribe.sh in the distributed project so its input handling, model retrieval, command construction, and runtime behavior can be audited before release.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The skill explicitly enables automatic downloading and transcription of voice notes, including from Telegram and WhatsApp, but does not provide a clear privacy notice or explain how audio files and transcripts are handled. Because voice notes can contain sensitive personal or business information, silently enabling this workflow can lead to unexpected collection, local storage, or further processing of sensitive data.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.