T09 · Insecure Skill Coding Practices
Error
- Location
index.js:266- Finding
Unauthenticated Webhook Permits Server-Side Retrieval of Attacker-Controlled Audio Resources
- Content
View full analysis
{ try { const { type, payload } = req.body; switch (type) { case 'audio.message': // Process an audio message from OpenClaw const { audio, userId, sessionId, language } = payload; const normalizedLanguage = language ? dialectMap.normalize(language) : null; const transcribeResult = await new Promise((resolve, reject) => { const options = { mode: 'json', pythonPath: process.env.PYTHON_PATH || 'python3', scriptPath: __dirname, args: [ audio, '--device', modelConfig.device, '--dtype', modelConfig.dtype, ], }; if (normalizedLanguage) { options.args.push('--language', normalizedLanguage); } PythonShell.run('asr.py', options, (err, results) => { if (err) reject(err); else resolve(results[0]); }); }); ``` ```python # asr.py def transcribe_audio( audio_input: str, language: Optional[str] = None, return_timestamps: bool = False, model_config: Optional[Dict[str, Any]] = None ) -> Dict[str, Any]: """ Args: audio_input: Audio path, URL, base64 data, or a numpy-array/sample-rate tuple """ results = model.transcribe( audio=audio_input, language=language, return_time_stamps=return_timestamps, ) ``` ### Technical Analysis The server listens on all network interfaces by default, while `/webhook` has no authentication, webhook signature verification, authorization ...[truncated 2541 chars]- Remediation
View remediation