Security audit

Local Speech Recognition

Security checks for vulnerabilities and agentic risk

Overview

This skill is a coherent local speech-to-text helper, with some setup and auto-transcription privacy caveats users should understand before installing.

Install this if you want local voice transcription and accept that first use may download/install model dependencies. Treat voice transcripts as sensitive because they are inserted into the conversation, and use the language argument or auto mode when Chinese is not the intended default.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (6)

Description-Behavior Mismatch

Medium

Confidence: 96% confidence
Finding: The skill advertises itself as fully offline/private with no API usage, yet also states that dependencies or models may be automatically downloaded on first use. This creates a misleading trust boundary: users may expose network metadata or pull unpinned remote artifacts when they believe the skill never contacts external sources.

Vague Triggers

Medium

Confidence: 93% confidence
Finding: The manifest/description says voice messages are auto-transcribed on receipt, but it does not define clear limits on what sources, file types, contexts, or sizes trigger execution. Broad auto-trigger behavior can lead to unintended processing of untrusted files, privacy surprises, or unnecessary resource consumption.

Intent-Code Divergence

Medium

Confidence: 95% confidence
Finding: Claiming the skill is 'fully offline & private' is inconsistent with later statements that it auto-downloads the model and auto-installs faster-whisper on first use. Such contradictory guidance can cause users to rely on privacy guarantees that are not true during setup, increasing supply-chain and privacy exposure.

Vague Triggers

Medium

Confidence: 90% confidence
Finding: The usage section states OpenClaw automatically invokes the transcription script and injects the result into the conversation, but does not describe boundaries, consent, or safeguards. In a skill that handles inbound media automatically, ambiguity around invocation rules increases the chance of accidental execution and disclosure of transcribed sensitive content.

Natural-Language Policy Violations

Medium

Confidence: 92% confidence
Finding: This code file contains a natural-language locale policy issue: the function signature sets `language="zh"` as the default, causing transcription to prefer Chinese unless the caller overrides it. The file does not present this as an explicit user choice, so it effectively forces a specific language by default.

Natural-Language Policy Violations

Medium

Confidence: 94% confidence
Finding: The command-line interface advertises `zh(默认)` and assigns `"zh"` when no language argument is provided, which enforces a specific language preference absent user opt-in. Under the policy, language constraints should be optional, user-selectable, or clearly justified as region-specific.

Static analysis

No suspicious patterns detected.