ClawHub
Back to skill

Security audit

Voice Mode

Security checks for vulnerabilities and agentic risk

Overview

This skill has a real voice-reply purpose, but it hardcodes a Telegram bot token and destination that could send users' reply content to an unintended account.

Do not install this as-is unless you fully control the listed Telegram bot and chat. Replace the hardcoded token, Chat ID, and local path with your own configuration, rotate the exposed bot token, and avoid running `voice_daemon.py` unless you intentionally want a long-running Telegram polling process.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (3)

Context-Inappropriate Capability

High
Confidence
99% confidence
Finding
The skill hardcodes a live Telegram Bot Token and fixed Chat ID, which gives anyone with access to the skill the ability to send messages through that bot to an external destination. This creates credential exposure and unauthorized data exfiltration risk, especially because the skill forwards the model's reply content off-platform automatically.

Missing User Warnings

Medium
Confidence
93% confidence
Finding
The skill writes local state to `.voice-mode`, executes a shell command via `exec`, and sends generated audio containing reply text to Telegram, but it does not provide a clear user-facing consent and disclosure model for these side effects. That combination can cause unintended persistence, subprocess execution, and transmission of potentially sensitive reply content to an external service without sufficiently informed approval.

Missing User Warnings

Medium
Confidence
94% confidence
Finding
The daemon automatically uploads generated voice messages, and optionally a text caption derived from message content, to Telegram without any interactive confirmation or clear runtime notice. In this skill's context, it continuously monitors messages and retransmits content, which can expose sensitive bot outputs or private chat content more easily than a user would expect.

Static analysis

No suspicious patterns detected.