ClawHub
Back to skill

Security audit

Asr Skill

Security checks across malware telemetry and agentic risk

Overview

This is a real local speech-to-text skill, but it exposes a network-facing audio service with under-scoped endpoints and weak deployment safeguards.

Install only in a controlled environment. Bind the service to 127.0.0.1 or firewall it, add authentication or signed webhook validation before exposure, review and patch dependency versions, and avoid sending sensitive voice recordings unless you understand local storage, transcript handling, and downstream model forwarding.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (24)

Tp4

High
Category
MCP Tool Poisoning
Confidence
91% confidence
Finding
The documentation describes a simple speech-to-text skill, but the analyzed behavior indicates additional HTTP endpoints, webhook handling, forced alignment, and timestamp/segmentation features that are not disclosed. Undocumented network-facing functionality expands the attack surface and can lead operators to expose services or data flows they did not intend to trust.

Missing User Warnings

Medium
Confidence
92% confidence
Finding
The uninstall section includes destructive `rm -rf` commands but does not clearly warn about irreversible data loss or instruct users to verify paths before running them. In installation documentation, shell commands are often copied verbatim, so even intended cleanup steps can cause accidental deletion if paths are modified, expanded unexpectedly, or executed from the wrong context.

Missing User Warnings

Medium
Confidence
92% confidence
Finding
The README explicitly states that user voice messages are automatically transcribed and then forwarded to the language model, but it does not disclose how audio/transcripts are handled, stored, retained, or protected. Because voice data can contain sensitive personal information and biometric characteristics, the lack of a privacy/data-handling warning can lead to unsafe deployment and uninformed user consent.

Missing User Warnings

Medium
Confidence
88% confidence
Finding
The code accepts audio_input as a path or URL and passes it to the model without validating or restricting remote fetch behavior. If the underlying library resolves URLs, an attacker could trigger unintended outbound network requests, potentially enabling SSRF-style access to internal resources, metadata endpoints, or privacy-impacting remote retrieval without user awareness.

Missing User Warnings

Medium
Confidence
87% confidence
Finding
The manifest explicitly supports audio upload and transcription, including file and base64 input, but provides no warning that voice recordings may contain highly sensitive personal, biometric, or confidential information. This is a real security/privacy issue because users may submit sensitive speech data without understanding retention, exposure, or handling risks, especially in a networked service context.

Missing User Warnings

Medium
Confidence
91% confidence
Finding
The skill is configured to listen on 0.0.0.0:3000, which exposes the transcription service on all network interfaces, yet the manifest does not warn users about network accessibility or access-control expectations. In context, this is more dangerous because the service accepts audio input and may process sensitive speech data; an unintentionally exposed endpoint could allow unauthorized use, data disclosure, or abuse.

Missing User Warnings

Medium
Confidence
83% confidence
Finding
The code accepts audio input as a path or URL and passes it directly into the model stack without any validation, allowlisting, or user-facing disclosure. If downstream libraries resolve remote URLs, this can enable server-side request forgery, unintended network access, or silent transmission of user-supplied data to external hosts, which is more concerning in a skill advertised as simple speech-to-text.

Unpinned Dependencies

Low
Category
Supply Chain
Content
# Python 依赖（极简版 - 仅 0.6B 模型）
torch>=2.0.0
qwen-asr>=0.0.6
transformers>=4.37.0
sentencepiece>=0.1.99
Confidence
93% confidence
Finding
Using a lower-bounded dependency like torch>=2.0.0 allows installation of any later version, including versions with breaking changes or known vulnerable releases. In a skill that processes audio via ML frameworks, this increases supply-chain and reproducibility risk because environments may silently resolve to unsafe or incompatible packages.

Unpinned Dependencies

Low
Category
Supply Chain
Content
# Python 依赖（极简版 - 仅 0.6B 模型）
torch>=2.0.0
qwen-asr>=0.0.6
transformers>=4.37.0
sentencepiece>=0.1.99
protobuf>=4.25.0
Confidence
90% confidence
Finding
qwen-asr>=0.0.6 is not pinned, so deployments may fetch different future releases with unreviewed code changes or newly introduced vulnerabilities. For an ASR skill, this can affect the model-loading and inference chain, increasing supply-chain exposure.

Unpinned Dependencies

Low
Category
Supply Chain
Content
# Python 依赖（极简版 - 仅 0.6B 模型）
torch>=2.0.0
qwen-asr>=0.0.6
transformers>=4.37.0
sentencepiece>=0.1.99
protobuf>=4.25.0
numpy>=1.24.0
Confidence
94% confidence
Finding
transformers>=4.37.0 permits any later release, which is risky for a library with a large attack surface involving model loading, tokenization, and serialization paths. In this skill, that is more relevant because ASR stacks commonly depend on external model artifacts and complex parsing logic.

Unpinned Dependencies

Low
Category
Supply Chain
Content
torch>=2.0.0
qwen-asr>=0.0.6
transformers>=4.37.0
sentencepiece>=0.1.99
protobuf>=4.25.0
numpy>=1.24.0
Confidence
89% confidence
Finding
sentencepiece>=0.1.99 is unpinned, so builds are non-deterministic and may pull in affected versions over time. While this dependency is narrower in scope than the main ML framework, it still participates in parsing/tokenization and can introduce memory-safety or denial-of-service issues.

Unpinned Dependencies

Low
Category
Supply Chain
Content
qwen-asr>=0.0.6
transformers>=4.37.0
sentencepiece>=0.1.99
protobuf>=4.25.0
numpy>=1.24.0
Confidence
93% confidence
Finding
protobuf>=4.25.0 leaves the environment free to resolve to later versions, including potentially affected releases. Because protobuf is often used for model/config serialization, vulnerable or incompatible versions can introduce parsing-based denial of service or unsafe deserialization exposure in the ML pipeline.

Unpinned Dependencies

Low
Category
Supply Chain
Content
transformers>=4.37.0
sentencepiece>=0.1.99
protobuf>=4.25.0
numpy>=1.24.0
Confidence
88% confidence
Finding
numpy>=1.24.0 is unpinned, which weakens reproducibility and can admit vulnerable or unstable versions. In an ASR skill this is usually a supporting dependency, but it still contributes native-code attack surface and dependency-chain risk.

Known Vulnerable Dependency: express==4.18.2 — 2 advisory(ies): CVE-2024-43796 (express vulnerable to XSS via response.redirect()); CVE-2024-29041 (Express.js Open Redirect in malformed URLs)

Low
Category
Supply Chain
Confidence
83% confidence
Finding
The manifest explicitly references express 4.18.2, which is flagged with known security advisories including redirect-related issues. In an HTTP-facing ASR skill exposing a POST endpoint, using a dependency with known web vulnerabilities increases attack surface, even if exploitability depends on how index.js handles redirects and response flows.

Known Vulnerable Dependency: multer==1.4.5-lts.1 — 7 advisory(ies): CVE-2025-47935 (Multer vulnerable to Denial of Service via memory leaks from unclosed streams); CVE-2025-47944 (Multer vulnerable to Denial of Service from maliciously crafted requests); CVE-2026-3520 (Multer Vulnerable to Denial of Service via Uncontrolled Recursion) +4 more

High
Category
Supply Chain
Confidence
96% confidence
Finding
The package uses multer 1.4.5-lts.1, which is flagged for multiple denial-of-service issues. This is particularly relevant in an audio transcription skill because it accepts uploaded audio via a POST /transcribe endpoint, so malformed or malicious multipart uploads could exhaust memory, leak resources, or crash the service.

Known Vulnerable Dependency: axios==1.6.0 — 10 advisory(ies): CVE-2025-62718 (Axios has a NO_PROXY Hostname Normalization Bypass that Leads to SSRF); CVE-2026-42044 (Axios: Invisible JSON Response Tampering via Prototype Pollution Gadget in `pars); CVE-2026-25639 (Axios is Vulnerable to Denial of Service via __proto__ Key in mergeConfig) +7 more

High
Category
Supply Chain
Confidence
91% confidence
Finding
The manifest references axios 1.6.0, which is associated with multiple advisories including SSRF-related and prototype-pollution/DoS concerns. In a skill that likely interacts with external model services or downloads resources, vulnerable HTTP client behavior can amplify risk if any user-controlled URLs, proxy settings, or untrusted response data are involved.

Known Vulnerable Dependency: express==4.18.2 — 2 advisory(ies): CVE-2024-43796 (express vulnerable to XSS via response.redirect()); CVE-2024-29041 (Express.js Open Redirect in malformed URLs)

Low
Category
Supply Chain
Confidence
89% confidence
Finding
This manifest includes express 4.18.2, which is flagged with known security advisories including open redirect and XSS-related issues in specific usage patterns. Even though package.json alone does not show vulnerable routes, an HTTP-facing ASR service is likely to expose Express handlers, so carrying a known-vulnerable version unnecessarily increases attack surface.

Known Vulnerable Dependency: multer==1.4.5-lts.1 — 7 advisory(ies): CVE-2025-47935 (Multer vulnerable to Denial of Service via memory leaks from unclosed streams); CVE-2025-47944 (Multer vulnerable to Denial of Service from maliciously crafted requests); CVE-2026-3520 (Multer Vulnerable to Denial of Service via Uncontrolled Recursion) +4 more

High
Category
Supply Chain
Confidence
97% confidence
Finding
The skill depends on multer 1.4.5-lts.1, which is reported as having multiple denial-of-service issues. In this skill context, file upload handling is central because the endpoint accepts audio for transcription, so a vulnerable multipart parser is especially dangerous and can allow crafted uploads to exhaust memory, CPU, or request-processing resources.

Known Vulnerable Dependency: axios==1.6.0 — 10 advisory(ies): CVE-2025-62718 (Axios has a NO_PROXY Hostname Normalization Bypass that Leads to SSRF); CVE-2026-42044 (Axios: Invisible JSON Response Tampering via Prototype Pollution Gadget in `pars); CVE-2026-25639 (Axios is Vulnerable to Denial of Service via __proto__ Key in mergeConfig) +7 more

High
Category
Supply Chain
Confidence
91% confidence
Finding
Axios 1.6.0 is identified as having multiple known advisories, including SSRF-related and prototype-pollution/DoS classes of issues. In an ASR skill that may call external services or fetch model/resources, a vulnerable HTTP client can become a pivot for outbound request abuse, internal network access, or process instability if attacker-controlled inputs reach request configuration.

Known Vulnerable Dependency: torch — 10 advisory(ies): CVE-2025-2953 (PyTorch susceptible to local Denial of Service); CVE-2022-45907 (PyTorch vulnerable to arbitrary code execution); CVE-2025-32434 (PyTorch: `torch.load` with `weights_only=True` leads to remote code execution) +7 more

Critical
Category
Supply Chain
Confidence
95% confidence
Finding
The requirement references torch without constraining it to a known safe release, and the static finding indicates multiple serious advisories affecting the package family, including code-execution and denial-of-service classes. In an ASR skill, PyTorch is central to model loading and tensor processing, so exploitation could compromise the host process or make the service unavailable.

Known Vulnerable Dependency: transformers — 10 advisory(ies): CVE-2023-2800 (transformers has Insecure Temporary File); CVE-2025-3933 (Transformers is vulnerable to ReDoS attack through its DonutProcessor class); CVE-2024-3568 (Transformers Deserialization of Untrusted Data vulnerability) +7 more

Critical
Category
Supply Chain
Confidence
94% confidence
Finding
transformers is flagged with multiple advisories, including insecure temporary file handling and unsafe deserialization classes, and the requirement does not restrict to a remediated version. This is particularly relevant in an ASR/model-serving skill because model processors and configuration loading are directly in the execution path.

Known Vulnerable Dependency: sentencepiece — 1 advisory(ies): CVE-2026-1260 (Sentencepiece has a a heap overflow issue)

High
Category
Supply Chain
Confidence
84% confidence
Finding
sentencepiece is reported as having a heap overflow advisory, and the current requirement does not ensure a patched version is selected. Since this library parses model/tokenization data, malformed inputs or artifacts could potentially crash the process or, in the worst case, enable memory-corruption exploitation.

Known Vulnerable Dependency: protobuf — 7 advisory(ies): CVE-2026-0994 (protobuf affected by a JSON recursion depth bypass); CVE-2022-1941 (protobuf-cpp and protobuf-python have potential Denial of Service issue); CVE-2025-4565 (protobuf-python has a potential Denial of Service issue) +4 more

Critical
Category
Supply Chain
Confidence
94% confidence
Finding
protobuf is associated with multiple denial-of-service and parsing-related advisories, and the unbounded requirement does not guarantee remediation. In an ML skill that may parse model metadata or structured data, vulnerable protobuf handling can be abused to exhaust resources or trigger unsafe parser behavior.

Known Vulnerable Dependency: numpy — 10 advisory(ies): CVE-2014-1859 (Numpy arbitrary file write via symlink attack); CVE-2021-41495 (NumPy NULL Pointer Dereference); CVE-2021-33430 (NumPy Buffer Overflow (Disputed)) +7 more

Critical
Category
Supply Chain
Confidence
87% confidence
Finding
numpy is flagged with multiple historical advisories and the requirement does not constrain installs to a safe version. While NumPy is often a foundational numeric library rather than the primary parsing surface, native-code vulnerabilities can still lead to crashes or unsafe file-handling behavior depending on usage.

VirusTotal

50/50 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.