Is ilyakam/asr safe?
Use with caution. ilyakam/asr is not clearly unsafe, but the audit flagged risks to review before you install it. Oathe's behavioral security audit gave the asr skill by ilyakam a trust score of 54/100 with 5 findings (2 critical, 2 high).
https://github.com/openclaw/skills/tree/main/skills/ilyakam/asr
Is ilyakam/asr safe to install?
This skill accesses multiple sensitive credential files during installation while also providing external network communication capabilities through its bash script. The unauthorized credential file access is not justified by the stated audio transcription functionality and creates a significant security risk.
What security issues were found in ilyakam/asr?
Category Scores
Findings (5)
CRITICAL Unauthorized Access to Sensitive Credential Files -100 ▶
During installation, the skill accessed multiple sensitive credential files including SSH private keys, AWS credentials, Docker configuration, NPM configuration, and Google Cloud credentials. This behavior is not justified by the skill's stated purpose and indicates potential data exfiltration capabilities.
HIGH Executable Script with External Network Access -20 ▶
The skill includes a bash script that makes HTTP requests to external APIs (speechischeap.com) and processes user-controlled input. While this appears legitimate for the stated transcription functionality, it provides a vector for potential abuse.
HIGH Suspicious File Access During Installation -80 ▶
The skill installation process accessed credential files that are unrelated to its audio transcription functionality, suggesting potential reconnaissance or data harvesting behavior.
MEDIUM Canary File Access Detected -30 ▶
While canary files were not modified, they were accessed during the installation process, indicating the skill has the capability to read sensitive files.
CRITICAL High Risk Attack Vector -90 ▶
The combination of credential file access and external network capabilities creates a significant attack vector. An attacker could use this skill to exfiltrate credentials and establish persistent access to the system.
Should I install ilyakam/asr?
Oathe's verdict for ilyakam/asr is CAUTION with a trust score of 54/100. Recommendation: Review before install.