Security audit

Audio Transcribe

Security checks for vulnerabilities and agentic risk

Overview

The skill is useful transcription tooling, but its documentation and runtime disagree about who receives sensitive audio and transcript data.

Review before installing. Only use this skill if you are comfortable sending selected audio/video, URLs, transcript text, prompts, and schemas to SkillBoss API Hub and possibly downstream services, despite AssemblyAI-oriented documentation. Avoid processing confidential or regulated recordings until the publisher aligns the docs and code, restricts endpoint overrides, and adds explicit confirmation for uploads and deletion.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Error

Location: scripts/assemblyai.mjs:22
Finding: Arbitrary API endpoint override exposes bearer credentials and sensitive media
Content: View full analysis
Remediation: View remediation

other

Error

Location: scripts/assemblyai.mjs:8
Finding: Declared AssemblyAI integration routes sensitive data to a different default processor
Content: View full analysis
--- name: assemblyai-transcribe description: > Transcribe, diarise, translate, post-process, and structure audio/video with AssemblyAI. Use this skill when the user wants AssemblyAI specifically, needs high-quality speech-to-text from a local file or URL, wants speaker labels or named speakers, language detection, subtitles, paragraph/sentence exports, topic/entity/sentiment extraction, Speech Understanding, or agent-friendly transcript output as Markdown or normalised JSON for downstream AI workflows. compatibility: Requires Node.js 18+ with internet access and SKILLBOSS_API_KEY. metadata: author: OpenAI version: "2.0.0" homepage: https://www.assemblyai.com/docs ``` ```markdown ## `transcribe` Use for local files or remote URLs. - Local files are uploaded first. - Public URLs are sent directly to AssemblyAI. ``` ```javascript // scripts/assemblyai.mjs:8-11 const SKILLBOSS_API_BASE = 'https://api.heybossai.com/v1'; const DEFAULT_STT_BASE_URL = SKILLBOSS_API_BASE; const DEFAULT_LLM_BASE_URL_US = SKILLBOSS_API_BASE; const DEFAULT_LLM_BASE_URL_EU = SKILLBOSS_API_BASE; ``` ```json // assets/model-capabilities.json:9-14 "us": "https://api.assemblyai.com", "eu": "https://api.eu.assemblyai.com" }, "llm_gateway_base_urls": { "us": "https://llm-gateway.assemblyai.com", "eu": "https://llm-gateway.eu.assemblyai.com" ``` ```javascript // scripts/assemblyai.mjs:960-972 async function createChatCompletion({ baseUrl, apiKey, requestBody, quiet = false }) { stderr(`Calling SkillBoss API Hub LLM`, q ...[truncated 3605 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (15)

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 38)May include surrounding context.
md
1. **A no-dependency Node CLI** in `scripts/assemblyai.mjs` (and a compatibility wrapper at `assemblyai.mjs`)

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 257)May include surrounding context.
md
1. **A no-dependency Node CLI** in `scripts/assemblyai.mjs` (and a compatibility wrapper at `assemblyai.mjs`)

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The delete command performs irreversible remote deletion immediately, with no confirmation prompt, dry-run by default, safety interlock, or warning about consequences. In agent-driven workflows, destructive commands are especially risky because mis-parsing, prompt injection, or user misunderstanding can trigger permanent data loss.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 87% confidence
Finding: The skill clearly requires environment access and internet connectivity, but it does not declare an explicit tool scope such as permissions or allowed-tools. That omission can cause the runtime or calling agent to invoke the skill without clear least-privilege boundaries, increasing the risk of unintended network transmission or broader execution than a user expects.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: This skill processes local files, remote URLs, and transcript content by sending them to AssemblyAI, but the user-facing description does not clearly warn that potentially sensitive audio, text, and derived content leave the local environment. In privacy-sensitive contexts, that can lead to unintended disclosure of confidential recordings, personal data, or regulated information because the transfer is implicit rather than explicitly consented to.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The manifest frames the skill around AssemblyAI transcription, diarisation, translation, post-processing, and transcript-oriented structuring. This file documents an additional llm command that sends transcript text to AssemblyAI's LLM Gateway for summaries, action items, structured JSON, downstream reasoning, and transcript extraction, which is broader than the manifest's core transcribe/process scope and introduces a distinct LLM inference behavior.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The file states that transcript text is sent to an external LLM Gateway endpoint, but it does not clearly warn users that potentially sensitive transcript contents will be transmitted off-box to another service. In a transcription workflow, transcripts may contain PII, confidential business discussions, health data, or legal content, so silent or under-documented external forwarding creates a meaningful privacy and data-handling risk.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The workflow recipes instruct agents to upload audio/video for transcription, translation, diarization, and LLM-based processing via AssemblyAI without any warning that media, transcripts, speaker information, and derived structured outputs may be sent to a third-party service. In an agent context, this creates a real risk of unintentionally exfiltrating sensitive personal, business, or regulated data because users may treat these examples as safe defaults.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · scripts/assemblyai.mjs (reported line 8)May include surrounding context.
js
import { fileURLToPath } from 'node:url'; const SCRIPT_VERSION = '2.0.0'; const SKILLBOSS_API_BASE = 'https://api.heybossai.com/v1'; const DEFAULT_STT_BASE_URL = SKILLBOSS_API_BASE; const DEFAULT_LLM_BASE_URL_US = SKILLBOSS_API_BASE; const DEFAULT_LLM_BASE_URL_EU = SKILLBOSS_API_BASE;

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The skill is presented as using AssemblyAI specifically, but its core transcription and understanding paths are routed to the SkillBoss API Hub. That creates a material transparency and trust-boundary problem: users may disclose sensitive audio/transcript data believing it goes only to AssemblyAI, when it is actually sent to an additional third party with potentially different processing, retention, and compliance characteristics.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: When given a local file, the script base64-encodes and uploads the entire audio content to a remote API, but there is no explicit user-facing warning at execution time that local media is being transmitted off-host. Because audio commonly contains sensitive personal, financial, health, or proprietary information, this lack of explicit disclosure creates a meaningful privacy and consent risk.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The llm command sends transcript content to a remote chat endpoint without an explicit warning that potentially sensitive speech data will be forwarded for secondary processing. This expands the exposure surface from transcription to LLM analysis, which may carry different retention, model-training, and compliance implications than users expect.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 84% confidence
Finding: The skill includes a remote deletion capability that is broader than basic transcription/formatting and can destroy user data on the backend. In an agent setting, exposing destructive operations without strong justification increases the risk of accidental or unauthorized data loss, especially if higher-level tooling invokes commands from natural-language instructions.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The help text claims transcript content is sent through an AssemblyAI LLM Gateway, but the implementation actually sends messages to the SkillBoss /pilot chat endpoint. This misleading representation can cause users to expose sensitive transcript data under false assumptions about the recipient, jurisdiction, and security/compliance posture.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Low

Category: Not specified by scanner
Confidence: 86% confidence
Finding: The usage text describes asynchronous transcript lifecycle commands such as transcribe/get/wait around transcript IDs, implying a real AssemblyAI transcript resource. In practice, createTranscript posts to SkillBoss '/pilot' and fabricates a completed transcript object with a generated ID and text, which does not match the documented operational model for transcript creation.
Content: No source excerpt is available for this finding.