Security audit
火一五媒体转写·百炼云 ASR
Security checks for vulnerabilities and agentic risk
Overview
This skill transparently sends user-approved media to Alibaba Bailian cloud transcription and shows no hidden or unrelated behavior.
Install this only if you intend to use Alibaba/DashScope cloud transcription. Before each run, confirm the recording may be exposed through an OpenClaw public share URL and processed by Alibaba cloud services; keep DASHSCOPE_API_KEY in the environment rather than chat or files, and use the local Whisper skill for confidential or offline transcription.
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Static analysis
No suspicious patterns detected.