openrouter-transcribe

clawhub:openrouter-transcribe

View source

92/100

First Seen

Feb 18, 2026

Last Scanned

Feb 22, 2026

Findings

Score

92/100

MEDIUM 1

LOW 1

Findings (2)

MEDIUM

Base64 encode and send EXFIL_009

exfiltration L39

Detects base64 encoding of content followed by transmission

Base64 encode + curl

FIX

Block patterns that base64-encode data and immediately transmit it. If base64 encoding is needed, ensure the encoded data does not contain secrets and destinations are allowlisted.

FP?

Likely FP if base64 encoding is used for legitimate purposes like encoding images for display or constructing data URIs, with no network transmission.

LOW

Shell script file execution CMDEXEC_013

command-execution L14

Detects execution of shell script files via bash/sh command or direct invocation

bash
{baseDir}/scripts/transcribe.sh

FIX

Replace direct shell script execution with a language-native implementation or a sandboxed executor. If shell scripts must run, restrict them to a vetted allowlist with integrity checks.

FP?

Likely FP if the match references running a script that is part of the skill's own repository (e.g., ./setup.sh) with clear, auditable contents.