Voice Recognition

• Outcome: Review
• Latest audit: Sep 16, 2026 · 8:10 AM UTC
• Version: 1.1.0

Overview

This appears to be a real local transcription skill, but it needs Review because installation and runtime behavior are broader and less safely scoped than the privacy/offline wording suggests.

Install only if you are comfortable with external package/model downloads and local ML dependencies. Prefer creating your own isolated virtual environment, pinning reviewed dependency versions, avoiding the bundled install fallback, and removing the /tmp/whisper-venv sys.path behavior before use on sensitive machines or shared systems.

A.I.G

Vulnerability Patterns

• Tool Hijacking and Spoofing: Modifies or replaces tools so legitimate-looking calls execute attacker logic
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T07 · Tool Hijacking and Spoofing

Error

• Location: scripts/transcribe.py:19
• Finding: Python Import-Path Hijacking Through a Shared Temporary Directory<![CDATA[ ## Vulnerability Details **File Location**: `scripts/transcribe.py:19-31` **Vulnerability Type**: Untrusted Python module search path **Risk Level**: High ### Vulnerable Code ```python # Ensure whisper venv is in path (fallback for different Python versions) _VENV_PATHS = [ '/tmp/whisper-venv/lib/python3.12/site-packages', '/tmp/whisper-venv/lib/python3.11/site-packages', '/tmp/whisper-venv/lib/python3.10/site-packages', ] for p in _VENV_PATHS: if os.path.exists(p): sys.path.insert(0, p) break import whisper import soundfile as sf import numpy as np ``` ### Technical Analysis The script conditionally inserts a predictable path under the shared `/tmp` directory at the beginning of `sys.path`. It verifies only that the path exists; it does not verify the directory's owner, permissions, canonical path, or integrity. Because the selected directory is placed at index zero, modules found there take precedence over packages installed in the legitimate Python environment. An attacker who creates `/tmp/whisper-venv` before the victim, or otherwise controls that directory, can provide malicious `whisper`, `soundfile`, or `numpy` modules. Python executes top-level module code immediately during import, before the transcription logic begins. The sticky-bit protection commonly applied to `/tmp` does not prevent this attack when the attacker creates the predictable directory first. It only restricts deletion or replacement of entries owned by other users. ### Attack Path 1. A local attacker anticipates that a victim or automated Agent will run `scripts/transcribe.py`. 2. The attacker creates one of the expected directory structures, such as: `/tmp/whisper-venv/lib/python3.12/site-packages/`. 3. The attacker places a malicious module or package at that location, such as `whisper.py` or `whisper/__init__.py`. 4. The victim executes `scripts/transcribe.py`. 5. The script detects the attacker-controlled directory and prepend ...[truncated 791 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove the shared `/tmp/whisper-venv` fallback and do not modify `sys.path` using predictable globally writable locations. 2. Invoke the project virtual environment's interpreter directly, for example: ```bash .venv/bin/python scripts/transcribe.py input.ogg ``` 3. If runtime path modification is unavoidable, use a project-owned directory and validate it before use: - Resolve the canonical path with `os.path.realpath()`. - Confirm that it is located inside the expected project directory. - Confirm that the current trusted user owns it. - Reject group-writable or world-writable directories. - Reject symbolic links and unexpected path components. 4. Create temporary directories with `tempfile.TemporaryDirectory()` when temporary storage is necessary. Do not reuse a fixed name under `/tmp`. 5. Run the Skill with least privilege and isolate it from sensitive credentials and unrelated files. ]]>

T08 · Insecure Dependencies

Warning

• Location: scripts/install.py:56
• Finding: Unpinned Runtime Dependencies Permit Unreviewed Supply-Chain Changes<![CDATA[ ## Vulnerability Details **File Location**: `scripts/install.py:56-90`; `requirements.txt:1-4` **Vulnerability Type**: Unpinned third-party dependency installation **Risk Level**: Medium ### Vulnerable Code From `scripts/install.py`: ```python packages = [ 'openai-whisper', 'soundfile', 'numpy', ] for pkg in packages: print(f" → Installing {pkg}...") result = subprocess.run( [pip_path, 'install', pkg], capture_output=True, text=True ) if result.returncode != 0: print(f" ⚠️ pip failed, trying with --break-system-packages...") result = subprocess.run( [pip_path, 'install', '--break-system-packages', pkg], capture_output=True, text=True ) # Install PyTorch (CPU) print(f" → Installing torch (CPU)...") result = subprocess.run( [pip_path, 'install', 'torch', '--index-url', 'https://download.pytorch.org/whl/cpu'], capture_output=True, text=True ) if result.returncode != 0: print(f" ⚠️ Retrying torch install...") result = subprocess.run( [pip_path, 'install', '--break-system-packages', 'torch', '--index-url', 'https://download.pytorch.org/whl/cpu'], capture_output=True, text=True ) ``` From `requirements.txt`: ```text openai-whisper>=20231117 soundfile>=0.12.0 numpy>=1.21.0 torch>=2.0.0 ``` ### Technical Analysis The bundled installer requests package names without versions, while `requirements.txt` specifies only lower bounds. Neither installation mechanism constrains dependencies to exact reviewed releases or verifies package artifacts with cryptographic hashes. Consequently, running the installer at different times can install materially different code. A future compromised, malicious, or incompatible upstream release satisfying these constraints would be accepted automatically. Transitive dependencies are also unresolved and unpinned. The fallback use of `--break-system-packages` increases the potential ...[truncated 1808 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Pin every direct dependency to a reviewed exact version rather than using unbounded names or minimum-version constraints. 2. Generate a fully resolved lock file that includes transitive dependencies for each supported Python version and platform. 3. Record trusted artifact hashes and install with hash verification: ```bash python -m pip install --require-hashes -r requirements.lock ``` 4. Obtain packages only from explicitly configured trusted indexes. Document and review the separate PyTorch index configuration. 5. Remove the automatic `--break-system-packages` fallback. If virtual-environment creation fails, stop with an actionable error instead of modifying a system-managed environment. 6. Use `sys.executable -m pip` from the verified project virtual environment to ensure dependencies are installed into the intended interpreter. 7. Add automated dependency vulnerability scanning and a controlled update process in which new versions and hashes are reviewed before the lock file is changed. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (18)

Intent-Code Divergence

Medium

• Confidence: 98% confidence
• Finding: The README makes absolute privacy/offline claims ('No internet required', '100% private') that conflict with later statements that the first run downloads Whisper models from external sources. This can mislead users operating in restricted or sensitive environments into running the skill under false assumptions about network access and supply-chain exposure.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The note mentions model download size but does not clearly warn, near the primary privacy/offline claims, that first use requires internet connectivity and pulls executable/model artifacts from external sources. In privacy-sensitive or air-gapped contexts, that omission can cause policy violations or unexpected outbound connections.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 85% confidence
• Finding: The skill documentation instructs users to run local scripts that can write files and invoke shell operations, but it does not declare any explicit tool scope such as permissions or allowed-tools. This creates an authorization and transparency gap: an agent or reviewer cannot easily determine what the skill is expected to access, increasing the risk of unintended file modification or command execution if the implementation is changed or abused.

Intent-Code Divergence

Medium

• Confidence: 96% confidence
• Finding: The installer documentation claims it creates a virtual environment and installs dependencies, but the code may instead fall back to system-wide installation. This mismatch is security-relevant because users may trust the script to remain isolated when it can actually modify the host environment and bypass package-management boundaries.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

import venv
            venv.main(['--without-pip', venv_dir])
            # Manually install pip
            subprocess.run(
                [sys.executable, '-m', 'ensurepip', '--upgrade', '--default-pip'],
                cwd=venv_dir, capture_output=True
            )

• Confidence: 70% confidence
• Finding: subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: The installer explicitly falls back to system pip when virtual environment setup fails, causing dependencies to be installed into the host Python environment. This is dangerous because it broadens package changes beyond the skill, can break OS-managed Python packages, and increases exposure to supply-chain issues from third-party dependencies.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The installer may proceed to system-level package modification with --break-system-packages without upfront warning or explicit user confirmation. This is dangerous because it bypasses normal environment protections and can alter system Python in a way users did not knowingly authorize.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

for pkg in packages:
        print(f"  → Installing {pkg}...")
        result = subprocess.run(
            [pip_path, 'install', pkg],
            capture_output=True, text=True
        )

• Confidence: 70% confidence
• Finding: subprocess module calls execute external commands. Without careful input validation, this enables command injection.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

)
        if result.returncode != 0:
            print(f"  ⚠️  pip failed, trying with --break-system-packages...")
            result = subprocess.run(
                [pip_path, 'install', '--break-system-packages', pkg],
                capture_output=True, text=True
            )

• Confidence: 86% confidence
• Finding: This retry path uses pip install --break-system-packages, bypassing distribution safeguards and potentially writing into the system Python environment. That is risky because an installer for an ordinary local transcription skill should not silently escalate from isolated install to host-level package modification without explicit consent.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

# Install PyTorch (CPU)
    print(f"  → Installing torch (CPU)...")
    result = subprocess.run(
        [pip_path, 'install', 'torch', '--index-url', 'https://download.pytorch.org/whl/cpu'],
        capture_output=True, text=True
    )

• Confidence: 70% confidence
• Finding: subprocess module calls execute external commands. Without careful input validation, this enables command injection.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

)
    if result.returncode != 0:
        print(f"  ⚠️  Retrying torch install...")
        result = subprocess.run(
            [pip_path, 'install', '--break-system-packages', 'torch',
             '--index-url', 'https://download.pytorch.org/whl/cpu'],
            capture_output=True, text=True

• Confidence: 84% confidence
• Finding: This call retries installation with --break-system-packages, which can override Python environment protections and modify the system interpreter outside an isolated virtual environment. In a one-click installer for a speech-to-text skill, that behavior expands the blast radius from the skill's sandbox to the host system and can destabilize or silently alter system-managed packages.

Intent-Code Divergence

Low

• Confidence: 90% confidence
• Finding: Claims such as 'No telemetry' and 'No data ever leaves your machine' are overbroad in context because installation and model acquisition contact third-party repositories. While this does not necessarily exfiltrate user audio, it creates inaccurate security assurances about network behavior and external dependencies.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

openai-whisper>=20231117
soundfile>=0.12.0
numpy>=1.21.0
torch>=2.0.0

• Confidence: 94% confidence
• Finding: The dependency is specified with a lower bound only, so builds may resolve to different versions over time. This weakens reproducibility and can unintentionally introduce vulnerable or breaking upstream releases into the environment.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

openai-whisper>=20231117
soundfile>=0.12.0
numpy>=1.21.0
torch>=2.0.0

• Confidence: 94% confidence
• Finding: The dependency is unpinned and may float to any newer release that satisfies the minimum version. That increases supply-chain risk and makes it harder to verify that tested and deployed environments use the same package set.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

openai-whisper>=20231117
soundfile>=0.12.0
numpy>=1.21.0
torch>=2.0.0

• Confidence: 96% confidence
• Finding: Using an unpinned numpy version allows installation of an arbitrary future compatible release, which may contain security issues or incompatible behavior. In this file, that concern is slightly elevated because numpy has multiple historical advisories and the manifest does not constrain to a reviewed version.

Unverifiable Dependency: numpy has 16 known advisory(ies) (CVE-2014-1859 (Numpy arbitrary file write via symlink attack); CVE-2021-41495 (NumPy NULL Pointer Dereference); CVE-2021-33430 (NumPy Buffer Overflow (Disputed)) +13 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 89% confidence
• Finding: The manifest does not pin numpy, so it is impossible to determine whether installations will receive a version affected by known advisories. This is primarily a dependency-hygiene and supply-chain exposure issue rather than proof of an active exploitable flaw in the skill itself.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

openai-whisper>=20231117
soundfile>=0.12.0
numpy>=1.21.0
torch>=2.0.0

• Confidence: 97% confidence
• Finding: An unpinned torch dependency is riskier than a typical library because PyTorch has had serious advisories, including code-execution and denial-of-service issues in some usage patterns. Without pinning, deployments may pick up an unreviewed release, increasing supply-chain and vulnerability exposure.

Unverifiable Dependency: torch has 16 known advisory(ies) (CVE-2025-2953 (PyTorch susceptible to local Denial of Service); CVE-2022-45907 (PyTorch vulnerable to arbitrary code execution); CVE-2025-32434 (PyTorch: `torch.load` with `weights_only=True` leads to remote code execution) +13 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 92% confidence
• Finding: Torch has a history of high-impact advisories, and because the version is not pinned, consumers may install a vulnerable build without realizing it. In a voice-recognition skill that processes user-supplied media locally, this does not by itself prove exploitability, but it increases the risk surface substantially if vulnerable torch functionality is present in the environment.

Static analysis

No suspicious patterns detected.