T08 · Insecure Dependencies
Warning
- Location
scripts/transcribe.py:17- Finding
Unpinned Remote Model Dependency Without Integrity Verification
- Content
View full analysis
- Remediation
View remediation
Security audit
Speech Recognition Local
Security checks for vulnerabilities and agentic risk
Overview
This skill is a coherent local speech-to-text tool, with some disclosed setup and dependency caveats users should understand.
Before installing, expect the first run to need external dependency/model retrieval unless already cached, and only allow automatic transcription for voice messages you are comfortable processing and injecting into the conversation.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)
Vulnerability Patterns
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (5)
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The skill metadata says voice messages are auto-triggered for transcription, but it does not define clear boundaries such as trusted sources, supported contexts, consent requirements, or explicit opt-in conditions. In an agent environment, overly broad automatic activation can cause unintended processing of user content, surprise execution, and possible denial-of-service or privacy issues if any matching audio attachment triggers the workflow.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The usage section states that OpenClaw automatically calls the transcription script when a voice message is received, but it does not specify when this should not happen or what qualifies as an eligible input. That ambiguity increases the chance that untrusted or unexpected audio files are processed automatically, which can expose the host to resource exhaustion, accidental data handling, or unsafe downstream behavior if transcripts are injected into conversations.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The command interface and surrounding usage guidance imply automatic invocation on provided audio files without clearly defining activation conditions or trust assumptions for the file path input. In context, this is risky because the skill processes externally supplied media and injects results into dialogue, so vague triggering semantics can expand the attack surface for untrusted content processing and unintended execution frequency.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
This code includes user-facing docstrings, status messages, errors, and usage text exclusively in Chinese. That creates a language policy issue because the skill requires a specific language for interaction and interpretation without offering an explicit user choice or alternative locale.
- Content
Intent-Code Divergence
Low
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The transcribe() docstring at L28 states that automatic language detection is the default, and the code at L71 also defaults to "auto" when no language is provided. However, the CLI help text at L67 says "zh(默认)", which actively misrepresents the actual default behavior.
- Content