audio to text and video to text

• Outcome: Pass
• Latest audit: May 29, 2026 · 8:23 PM UTC
• Version: 1.0.0

Overview

This is a coherent transcription skill, but users should be careful because it sends media to OpenAI, handles an API key, and may install Python dependencies at runtime.

Install only if you are comfortable sending the selected audio or video content to OpenAI for transcription and using your own OpenAI account for API usage. Configure OPENAI_API_KEY through a secure environment variable or secret manager, avoid pasting long-lived keys into chat, and preinstall or pin dependencies instead of allowing runtime pip installs on shared or sensitive machines.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (16)

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

import openai as _openai
    except ImportError:
        print("Installing openai...", flush=True)
        subprocess.check_call([sys.executable, "-m", "pip", "install",
                               "openai", "--break-system-packages", "-q"])
        import openai as _openai

• Confidence: 95% confidence
• Finding: subprocess.check_call([sys.executable, "-m", "pip", "install", "openai", "--break-system-packages", "-q"])

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

import openai as _openai
    except ImportError:
        print("Installing openai...", flush=True)
        subprocess.check_call([sys.executable, "-m", "pip", "install",
                               "openai", "--break-system-packages", "-q"])
        import openai as _openai

• Confidence: 93% confidence
• Finding: subprocess.check_call([sys.executable, "-m", "pip", "install", "openai", "--break-system-packages", "-q"])

Context-Inappropriate Capability

Medium

• Confidence: 97% confidence
• Finding: The skill instructs the agent to ask the user for an OpenAI API key, creating unnecessary credential collection and handling inside the conversation flow. This is dangerous because API keys are high-value secrets, may be exposed in chat logs, and are not required if the platform should be brokering model access itself.

Context-Inappropriate Capability

Medium

• Confidence: 91% confidence
• Finding: The skill explicitly requires obtaining and using a user's raw OpenAI API key, which expands the skill from simple transcription into secret collection and handling. This creates unnecessary credential-exposure risk because users may paste secrets into chat or workflows that are not designed to safely store or redact them.

Context-Inappropriate Capability

Medium

• Confidence: 84% confidence
• Finding: The documentation directs the agent to install Python packages and potentially alter the runtime environment to satisfy the skill, which exceeds the narrow transcription function. Allowing arbitrary environment modification increases attack surface, can introduce unreviewed dependencies, and may affect other workloads on the host.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: Recommending `sudo apt install ffmpeg` introduces privileged system modification into a skill whose purpose is media transcription. If followed by an automated agent, this could grant elevated execution paths, alter the host, and create opportunities for persistence or broader compromise beyond the user's task.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: The skill changes the Python environment at runtime by invoking pip, which is unnecessary for core transcription logic and can execute unreviewed package install steps. In agent or hosted environments, this can bypass expected immutability and create a path for supply-chain abuse or persistence.

Vague Triggers

Medium

• Confidence: 88% confidence
• Finding: The trigger guidance is so broad that the skill may activate whenever a user mentions media or asks what was said, even when they did not intend third-party transcription or shell-based file handling. Over-broad invocation can cause unintended processing of sensitive media, surprise data transfer, and unnecessary access to local files.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The skill describes sending media chunks to OpenAI's API but does not require a user-facing warning that uploaded audio/video and transcript data leave the local environment. This omission is dangerous because users may unknowingly submit sensitive recordings, personal data, or confidential business discussions to a third-party service.

Missing User Warnings

Medium

• Confidence: 98% confidence
• Finding: The skill asks the user to provide an API key but gives no warning not to disclose secrets in chat or guidance on secure handling. This creates a direct secret-exposure path through conversational logs, debugging traces, and downstream tooling that may capture plaintext credentials.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The script uploads user-supplied audio content to the OpenAI transcription API but does not present a clear runtime disclosure or consent check before external transmission. In a transcription skill, this is especially relevant because recordings may contain sensitive conversations, credentials, health data, or regulated personal information.

Vague Triggers

High

• Confidence: 88% confidence
• Finding: The trigger guidance is so broad that it instructs use of the skill even when the system is unsure, increasing the chance of unnecessary activation on unrelated requests. In this skill, over-triggering is especially risky because activation can lead to file handling, external API submission, dependency installation, and secret collection.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The overview describes sending media chunks to OpenAI and optionally sending transcript content for cleanup, but it does not clearly warn users that their audio/video data and derived text will be transmitted to external services. This can cause unintentional disclosure of sensitive recordings, especially for meetings, medical, legal, or business content.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The instructions tell the user to provide an API key directly, without any warning about secure handling, redaction, or safer alternatives. This normalizes secret sharing in conversation and increases the likelihood of credential leakage through logs, transcripts, or downstream tooling.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The script uploads user-provided audio content to a remote transcription API without any explicit notice or consent mechanism in the workflow. For a transcription skill this is functionally expected, but it is still a real privacy and data-handling issue when processing sensitive recordings, meetings, or regulated content.

Ssd 3

Medium

• Confidence: 98% confidence
• Finding: This is a direct secret-handling flaw: the skill asks for a raw API key in conversation and then passes it into the command workflow. Exposed API keys can be stolen from chat history, logs, or debugging output and then abused for unauthorized API usage, cost fraud, or access to associated account resources.

VirusTotal

64/64 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.