Is clawsec-suite safe?
https://clawhub.ai/davida-ps/clawsec-suite
Moltspaces is a voice bot skill that joins public audio rooms using WebRTC. While the Python code itself is clean and legitimate, the skill raises significant concerns: it creates a .env file containing multiple API keys (creating cross-skill attack surface), launches a persistent background process that speaks user-authored content aloud in public rooms (potential data leak), requires a heavy dependency installation including a full Python runtime, and registers the user's agent via an unauthenticated API endpoint. No malicious intent was found, but the combination of credential storage, public audio output, and persistent background processes warrants careful review.
Category Scores
Findings (10)
HIGH Bot speaks user content in public audio rooms -25 ▶
The bot reads personality.md and notes.md (user-authored content) and uses them as context for an LLM that generates spoken responses in public Daily.co WebRTC rooms. Any sensitive information in these files could be spoken aloud to unknown participants. There is no content filtering or privacy boundary.
HIGH Heavy dependency tree with system-level installation -35 ▶
The skill requires installing uv (a Python package manager), a full Python 3.11 runtime, and a large dependency tree including pipecat-ai with WebRTC, audio processing (onnxruntime, silero), FastAPI, uvicorn, and aiohttp. The pyproject.toml also overrides onnxruntime to a specific version (1.18.0). This is a substantial system modification with a large transitive dependency attack surface.
HIGH Skill instructs agent to create .env with multiple API keys -20 ▶
SKILL.md explicitly instructs the agent to create or update a .env file containing OPENAI_API_KEY, ELEVENLABS_API_KEY, MOLTSPACES_API_KEY, and MOLT_AGENT_ID. While this is necessary for the skill's function, it normalizes the practice of the agent writing sensitive credentials to disk and creates a high-value target file that other skills could read.
MEDIUM Agent directed to make autonomous API calls to third-party services -15 ▶
The SKILL.md instructs the agent to make curl requests to api.elevenlabs.io (with the user's API key in a header) and api.moltspaces.com (unauthenticated registration). This trains the agent to send data to external services as part of setup, which could be exploited by prompt injection in the skill content.
MEDIUM Persistent background process after agent interaction -20 ▶
The skill instructs the agent to launch bot.py as a background process (with & and stdout/stderr redirected to bot.log). This process persists after the agent interaction ends, joining a WebRTC room and using the user's API keys. The user may forget this process is running, leading to unexpected API usage charges.
MEDIUM Unauthenticated agent registration sends user data to third party -15 ▶
The agent registration endpoint requires no API key. The agent sends user-chosen name, bio, and metadata to api.moltspaces.com without any authentication. The response includes an API key that cannot be retrieved again — if lost, the user loses access to their registered agent.
MEDIUM Cross-skill attack surface via .env and personality files -30 ▶
This skill creates a .env file with multiple high-value API keys and reads from user-authored files (personality.md, notes.md). A malicious companion skill could: (1) read the .env to exfiltrate API keys, (2) modify personality.md to inject content that the bot will speak aloud, or (3) modify notes.md to change the bot's talking points. The skill creates several files that become cross-skill attack vectors.
LOW Agent makes autonomous decisions about voice selection -10 ▶
SKILL.md instructs the agent to autonomously 'select a voice ID from the list that best matches the bot's personality' if the user doesn't provide one. This is a minor autonomy concern — the agent makes decisions that may incur API costs on the user's ElevenLabs account without explicit approval.
LOW Installation timeout during dependency resolution -10 ▶
The skill installation timed out with a 'Non-error was thrown: Timeout' error. While no malicious activity was detected, the timeout could indicate an excessively large dependency tree or network issues. The fact that the install didn't complete means the full install-time behavior was not observed.
INFO Bot.py is a legitimate voice bot application 0 ▶
The Python code in bot.py appears to be a legitimate voice bot built on the pipecat-ai framework. It uses standard patterns for WebRTC audio, STT/TTS, and LLM integration. No obfuscated code, hidden imports, or suspicious logic was found. The code is well-commented and follows normal async patterns.