ClawHub
Back to skill

Security audit

Audio Transcribe

Security checks for vulnerabilities and agentic risk

Overview

The skill broadly does audio transcription as advertised, but it defaults to sensitive speaker-gender inference and has optional LLM paths that can transmit transcript, speaker context, and reference material to external providers with weak prompt-injection boundaries.

Install only if you are comfortable processing sensitive audio with this tool. Use --no-detect-gender if you do not want demographic inference, and omit --model or use --skip-llm to keep transcript cleanup local. Only provide trusted reference and speaker-context files when LLM cleanup is enabled, review any OpenAI-compatible base URL, and run setup commands in an isolated virtual environment after checking the sudo and unpinned dependency behavior.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/transcribe.py:919
Finding

Untrusted Reference Material Is Inserted into a Privileged LLM System Prompt

Content
View full analysis
4000: notes_text += "\n[...truncated]" prompt += ( "\n\nReference material (show notes / meeting agenda). " "Use this to correct ASR errors — proper nouns, person names, " "organization names, technical terms, and topic keywords in this " "document are authoritative spellings:\n\n" + notes_text ) ``` The constructed prompt is subsequently used as follows: ```python system_prompt = build_system_prompt(speaker_context, reference_text, speaker_names, speaker_genders) cleaned = [] failed_chunks = [] if cache_dir: cache_dir.mkdir(exist_ok=True) print(f" LLM cleanup: {len(chunks)} chunks, model: {model_id} " f"(provider: {effective_provider})") for i, chunk in enumerate(chunks): cache_file = cache_dir / f"chunk_{i:03d}.txt" if cache_dir else None if cache_file and cache_file.exists(): cleaned.append(cache_file.read_text(encoding="utf-8")) print(f" chunk {i+1}/{len(chunks)} (cached)") continue chunk_text = format_chunk(chunk, speaker_map) user_msg = (f"Clean the following meeting transcrip ...[truncated 2580 chars]
Remediation
View remediation

T08 · Insecure Dependencies

Warning
Location
scripts/setup_env.sh:123
Finding

Setup Scripts Install Unpinned Third-Party Dependencies Without Integrity Verification

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • System Prompt LeakageDirect Leakage, Indirect Extraction, Tool-Based Exfiltration
Findings (60)

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding

The skill performs speaker gender inference and also extracts gender hints from reference text, which is more sensitive processing than ordinary transcription. Inferring sensitive personal attributes from audio can create privacy, compliance, and misuse risks, especially when users may not expect or consent to that analysis.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding

The skill performs speaker gender inference and also extracts gender hints from reference text, which is more sensitive processing than ordinary transcription. Inferring sensitive personal attributes from audio can create privacy, compliance, and misuse risks, especially when users may not expect or consent to that analysis.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding

The skill performs speaker gender inference and also extracts gender hints from reference text, which is more sensitive processing than ordinary transcription. Inferring sensitive personal attributes from audio can create privacy, compliance, and misuse risks, especially when users may not expect or consent to that analysis.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding

The skill performs speaker gender inference and also extracts gender hints from reference text, which is more sensitive processing than ordinary transcription. Inferring sensitive personal attributes from audio can create privacy, compliance, and misuse risks, especially when users may not expect or consent to that analysis.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
96% confidence
Finding

The skill performs speaker gender inference and also extracts gender hints from reference text, which is more sensitive processing than ordinary transcription. Inferring sensitive personal attributes from audio can create privacy, compliance, and misuse risks, especially when users may not expect or consent to that analysis.

Content

No source excerpt is available for this finding.

Credential Access

High
Category
Privilege Escalation
Confidence
90% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 29)May include surrounding context.

md
env_vars:
      - name: AWS_REGION
        required: false
        description: "AWS region for Bedrock LLM cleanup (default: us-west-2). Bedrock uses the standard AWS credential chain (IAM role, SSO, ~/.aws/credentials, env vars) — no explicit keys needed."
      - name: ANTHROPIC_API_KEY
        required: false
        description: "API key for Anthropic Claude LLM cleanup"

Credential Access

High
Category
Privilege Escalation
Confidence
90% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 146)May include surrounding context.

md
env_vars:
      - name: AWS_REGION
        required: false
        description: "AWS region for Bedrock LLM cleanup (default: us-west-2). Bedrock uses the standard AWS credential chain (IAM role, SSO, ~/.aws/credentials, env vars) — no explicit keys needed."
      - name: ANTHROPIC_API_KEY
        required: false
        description: "API key for Anthropic Claude LLM cleanup"

Credential Access

High
Category
Privilege Escalation
Confidence
90% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 166)May include surrounding context.

md
env_vars:
      - name: AWS_REGION
        required: false
        description: "AWS region for Bedrock LLM cleanup (default: us-west-2). Bedrock uses the standard AWS credential chain (IAM role, SSO, ~/.aws/credentials, env vars) — no explicit keys needed."
      - name: ANTHROPIC_API_KEY
        required: false
        description: "API key for Anthropic Claude LLM cleanup"

External Model or Provider Selection

High
Category
Excessive Agency
Confidence
90% confidence
Finding

Allowing explicit selection of an external provider such as Anthropic means transcript content and associated context can be sent to a third-party service. In a meeting/podcast transcription context, that data may contain confidential business discussions or personal information, so uncontrolled provider selection materially increases exfiltration risk.

Content

Scanner excerpt · SKILL.md (reported line 181)May include surrounding context.

md
# Anthropic API (requires ANTHROPIC_API_KEY env var)
python3 $SCRIPTS/transcribe.py meeting.wav \
    --provider anthropic --model claude-sonnet-4-6

# OpenAI-compatible API (requires OPENAI_API_KEY env var)
python3 $SCRIPTS/transcribe.py meeting.wav \

External Model or Provider Selection

High
Category
Excessive Agency
Confidence
90% confidence
Finding

OpenAI-compatible provider selection is especially risky because a custom base URL can redirect transcript data to arbitrary third-party or self-hosted endpoints. That broad network flexibility makes it easy to bypass intended trust boundaries and send sensitive audio-derived text to unvetted services.

Content

Scanner excerpt · SKILL.md (reported line 185)May include surrounding context.

md
# OpenAI-compatible API (requires OPENAI_API_KEY env var)
python3 $SCRIPTS/transcribe.py meeting.wav \
    --provider openai --model gpt-4o

# Full pipeline with all supporting files + LLM (best quality)
python3 $SCRIPTS/transcribe.py episode.m4a \

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
85% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · references/pipeline-details.md (reported line 378)May include surrounding context.

sudo swapon /swapfile

After transcription, optionally remove swap

sudo swapoff /swapfile && sudo rm /swapfile

text

**Fix B — use `zh-basic` instead of `zh`:**

Chaining Abuse

High
Category
Tool Misuse
Confidence
75% confidence
Finding

Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.

Content

Scanner excerpt · references/pipeline-details.md (reported line 378)May include surrounding context.

md
if ! command -v ffmpeg &>/dev/null; then
    echo "Installing ffmpeg..."
    if command -v apt-get &>/dev/null; then
        sudo apt-get update -qq && sudo apt-get install -y -qq ffmpeg
    elif command -v brew &>/dev/null; then
        brew install ffmpeg
    else

Chaining Abuse

High
Category
Tool Misuse
Confidence
75% confidence
Finding

Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.

Content

Scanner excerpt · references/pipeline-details.md (reported line 398)May include surrounding context.

md
if ! command -v ffmpeg &>/dev/null; then
    echo "Installing ffmpeg..."
    if command -v apt-get &>/dev/null; then
        sudo apt-get update -qq && sudo apt-get install -y -qq ffmpeg
    elif command -v brew &>/dev/null; then
        brew install ffmpeg
    else

Chaining Abuse

High
Category
Tool Misuse
Confidence
75% confidence
Finding

Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.

Content

Scanner excerpt · references/pipeline-details.md (reported line 399)May include surrounding context.

md
if ! command -v ffmpeg &>/dev/null; then
    echo "Installing ffmpeg..."
    if command -v apt-get &>/dev/null; then
        sudo apt-get update -qq && sudo apt-get install -y -qq ffmpeg
    elif command -v brew &>/dev/null; then
        brew install ffmpeg
    else

Chaining Abuse

High
Category
Tool Misuse
Confidence
75% confidence
Finding

Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.

Content

Scanner excerpt · scripts/setup_env.sh (reported line 56)May include surrounding context.

sh
if ! command -v ffmpeg &>/dev/null; then
    echo "Installing ffmpeg..."
    if command -v apt-get &>/dev/null; then
        sudo apt-get update -qq && sudo apt-get install -y -qq ffmpeg
    elif command -v brew &>/dev/null; then
        brew install ffmpeg
    else

Context-Inappropriate Capability

High
Category
Not specified by scanner
Confidence
97% confidence
Finding

This file adds speaker gender inference and reference-text gender extraction even though the skill manifest is focused on transcription, diarization, and meeting/podcast text generation. Inferring a sensitive demographic attribute from audio and metadata expands data processing beyond user expectations and creates privacy, compliance, and misuse risks, especially because the file explicitly allows reference hints to override model output.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High
Category
Not specified by scanner
Confidence
99% confidence
Finding

The code performs demographic inference from voice segments using a two-class gender model, which is sensitive-attribute processing unrelated to core speech-to-text. This is dangerous because it can misgender users, produce discriminatory metadata, and create legal/privacy exposure when users only asked for transcription.

Content

No source excerpt is available for this finding.

Anti-Refusal Statement

High
Category
Anti-Refusal
Confidence
80% confidence
Finding

Skill instructs the agent to omit warnings, disclaimers, or ethical commentary. Stripping safety caveats hides risk from the user and is a common jailbreak preamble.

Content

Scanner excerpt · scripts/test_speaker_verification.py (reported line 2132)May include surrounding context.

python
assert "hit iteration cap" in captured

    def test_clean_convergence_no_cap_warning(self, capsys):
        """4-speaker rotation resolves in exactly N-1=3 swaps → no warning."""
        transcript = [
            make_segment(0, 0, 5000, "大家好我是赵六"),
            make_segment(1, 5000, 10000, "大家好我是张三"),

Direct Prompt Extraction

High
Category
System Prompt Leakage
Confidence
85% confidence
Finding

Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.

Content

Scanner excerpt · scripts/transcribe.py (reported line 939)May include surrounding context.

python
+ notes_text
        )

    return prompt


def _verify_speaker_roles_via_llm(first_chunk_text: str, speaker_map: dict,

External Model or Provider Selection

High
Category
Excessive Agency
Confidence
90% confidence
Finding

Skill selects an external model or provider that may use a different account or billing plan than the operator expects. Undisclosed model switches can cause unexpected cost or quota consumption.

Content

Scanner excerpt · scripts/verify_speakers.py (reported line 34)May include surrounding context.

python
python3 verify_speakers.py podcast_raw_transcript.json \
      --speakers "Host,Guest" \
      --speaker-context ctx.json \
      --minutes 5 --model claude-sonnet-4-6
"""

import argparse

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
90% confidence
Finding

The skill declares substantial capabilities (shell execution, filesystem access, environment-variable use, and network access) but does not scope them with explicit permissions or allowed-tools metadata. In an agent environment, this weakens least-privilege controls and makes it easier for the skill to access local files, invoke external binaries, and reach external services beyond what is strictly necessary.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The document explicitly states that --speaker-context content is injected into the LLM system prompt for cleanup. In this skill's context, speaker-context may contain names, roles, internal projects, HR details, or other meeting-sensitive metadata, so sending it to an external LLM without a clear privacy warning or consent boundary creates a real data exposure risk.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
86% confidence
Finding

The documentation recommends nohup ... & to detach long-running transcription from the agent session. In an agent skill context, backgrounding work outside normal session supervision reduces visibility, persists after the initiating session ends, and can continue processing sensitive audio or consuming resources without active user awareness.

Content

Scanner excerpt · references/pipeline-details.md (reported line 356)May include surrounding context.

Option B: nohup (works everywhere):

bash
nohup bash -c 'source .venv/bin/activate && python3 transcribe.py meeting.flac \
  --lang zh --num-speakers 9 --skip-llm' > transcribe.log 2>&1 &

echo $!  # Save PID for monitoring

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
70% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · references/pipeline-details.md (reported line 372)May include surrounding context.

Fix A — add swap before running (requires root):

bash
sudo fallocate -l 4G /swapfile
sudo chmod 600 /swapfile
sudo mkswap /swapfile
sudo swapon /swapfile

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
70% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · references/pipeline-details.md (reported line 373)May include surrounding context.

Fix A — add swap before running (requires root):

bash
sudo fallocate -l 4G /swapfile
sudo chmod 600 /swapfile
sudo mkswap /swapfile
sudo swapon /swapfile