audio to text and video to text

• Outcome: Review
• Latest audit: Sep 12, 2026 · 5:19 AM UTC
• Version: 1.0.0

Overview

The skill performs a coherent transcription workflow, but it asks for raw API keys in chat and can modify the Python environment at runtime with unpinned installs.

Review before installing. Use this only for media you are comfortable sending to OpenAI for transcription, configure the API key through a secure environment or secret mechanism rather than chat or --api-key, and avoid letting the skill install packages at runtime or use sudo on your behalf. Prefer a managed environment with preinstalled, pinned dependencies and ffmpeg already available.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: scripts/transcribe.py:61
• Finding: Unpinned Dependency Installation at Runtime<![CDATA[ ## Vulnerability Details **File Location**: `scripts/transcribe.py:61-68` **Mirrored Location**: `transcription/scripts/transcribe.py:61-68` **Related Documentation**: `SKILL.md:34-42`, `transcription/SKILL.md:34-42` **Vulnerability Type**: Unpinned and automatic third-party dependency installation **Risk Level**: Medium ### Vulnerable Code ```python def ensure_openai(api_key): """Import openai and set the API key.""" try: import openai as _openai except ImportError: print("Installing openai...", flush=True) subprocess.check_call([sys.executable, "-m", "pip", "install", "openai", "--break-system-packages", "-q"]) import openai as _openai ``` The Skill documentation additionally instructs users to execute: ```bash pip install openai pydub --break-system-packages -q ``` ### Technical Analysis When the `openai` module is unavailable, the script automatically invokes `pip` and installs the latest package version available from the configured Python package index. No version constraint, lockfile, package hash, trusted index restriction, or artifact signature is used. Consequently, the code reviewed during the audit does not fully determine the code that will execute at runtime. The installed package and its transitive dependencies can change after the Skill has been reviewed. The use of `--break-system-packages` further allows pip to modify a Python environment managed by the operating system or another package manager. The documentation also installs `pydub`, although the audited scripts do not import or otherwise use that package. This unnecessarily expands the dependency and supply-chain attack surface. Exploitation requires compromise of a package release, a transitive dependency, the configured package index, or package-resolution infrastructure. No evidence was found that this project deliberately points pip to a malicious package or repository. ### Attack Path ...[truncated 1663 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove automatic package installation from application runtime. Fail with a clear dependency error instead. 2. Declare dependencies in a reviewed dependency file and pin exact versions, including transitive dependencies. 3. Use a lockfile and require package hashes, such as: ```text openai==<reviewed-version> --hash=sha256:<reviewed-hash> ``` 4. Install dependencies during a controlled build or setup phase rather than when processing user media. 5. Use an isolated virtual environment or container and remove `--break-system-packages`. 6. Restrict installation to a trusted package index and validate the configured pip index. 7. Generate and review a software bill of materials and periodically scan dependencies for known vulnerabilities. 8. Remove `pydub` from the installation instructions unless the implementation actually requires it. 9. Apply least privilege and prevent the transcription process from writing to shared package or system directories. ]]>

T09 · Insecure Skill Coding Practices

Note

• Location: scripts/transcribe.py:39
• Finding: OpenAI API Key Exposed Through Command-Line Arguments<![CDATA[ ## Vulnerability Details **File Location**: `scripts/transcribe.py:39` **Additional Location**: `scripts/transcribe.py:70-77` **Mirrored Locations**: `transcription/scripts/transcribe.py:39`, `transcription/scripts/transcribe.py:70-77` **Related Documentation**: `SKILL.md:44-47`, `transcription/SKILL.md:44-47` **Vulnerability Type**: Sensitive credential passed through the process argument vector **Risk Level**: Low ### Vulnerable Code The script accepts an API key directly as a command-line argument: ```python p.add_argument("--api-key", default=None, help="OpenAI API key") ``` It then selects the command-line value before the environment variable: ```python key = api_key or os.environ.get("OPENAI_API_KEY") if not key: print("\n❌ OpenAI API key not found.") print(" Set OPENAI_API_KEY in your environment or pass --api-key <key>") print(" Get a key at: https://platform.openai.com/api-keys") sys.exit(1) _openai.api_key = key ``` The documented Quick Start encourages this invocation pattern: ```bash python /home/claude/transcription/scripts/transcribe.py \ --input "/path/to/media/file" \ --output "/mnt/user-data/outputs/transcript.txt" \ --api-key "$OPENAI_API_KEY" ``` Although the shell expression references an environment variable, the shell expands it before starting Python. The resulting process argument vector therefore contains the plaintext API key. ### Technical Analysis Command-line arguments may be exposed through process-inspection interfaces, diagnostic tooling, job schedulers, monitoring agents, crash reports, audit logs, shell tracing, or orchestration metadata. Exposure depends on operating-system permissions and deployment configuration; it is not necessarily available to every unprivileged user. The implementation does not print the key itself, and no hardcoded credential was found. The weakness is that the supported and documented CLI interface creates an avoidable plaintext copy of the cr ...[truncated 1578 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove the `--api-key` command-line option and retrieve the credential only from a protected secret source. 2. Prefer a secret manager or platform-native secret injection mechanism. If unavailable, use `OPENAI_API_KEY` without repeating it in the command-line arguments. 3. Change the documented command to: ```bash python /home/claude/transcription/scripts/transcribe.py \ --input "/path/to/media/file" \ --output "/mnt/user-data/outputs/transcript.txt" ``` 4. Update error messages so they do not recommend passing the credential as an argument. 5. Ensure monitoring, job-control, and audit systems redact environment variables and command fields that may contain secrets. 6. Scope the OpenAI key to the minimum required project and permissions, enforce spending limits, and rotate it regularly. 7. If interactive credential entry is necessary, use a non-echoing prompt such as `getpass.getpass()` and avoid persisting the value. 8. Review deployment logs and process telemetry for historical exposure, then rotate any credential that may have been recorded. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import

Findings (24)

Vague Triggers

High

• Confidence: 98% confidence
• Finding: The trigger guidance is overly broad, including catch-all conditions like using the skill whenever there is uncertainty or whenever a media file is referenced. Overbroad activation can cause the agent to route unrelated requests into a workflow that accesses local files and sends user media to an external API without sufficiently specific user intent.

Vague Triggers

High

• Confidence: 98% confidence
• Finding: The trigger guidance is overly broad, including catch-all conditions like using the skill whenever unsure whether transcription is involved. This can cause the agent to invoke the skill in contexts where external processing, file handling, or API use was not clearly intended by the user, increasing the chance of improper data disclosure or unnecessary execution.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 94% confidence
• Finding: The skill invokes shell commands, accesses environment variables, and writes files, but it does not declare any explicit tool scope or permission boundaries. This increases the chance an agent will execute privileged actions implicitly, reducing auditability and making misuse or overreach harder to contain.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The skill describes sending audio chunks to OpenAI's Whisper API but does not clearly warn users that their media content will be transmitted to an external service. This creates a privacy and consent risk, particularly for sensitive meetings, recordings, or regulated data.

Context-Inappropriate Capability

Medium

• Confidence: 96% confidence
• Finding: The skill tells the agent to request a raw OpenAI API key from the user, creating a credential collection flow not safely bounded by the platform. Asking for secrets in-band increases the risk of accidental retention, logging, reuse, or exfiltration, especially because the skill also uses shell and environment access.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

import openai as _openai
    except ImportError:
        print("Installing openai...", flush=True)
        subprocess.check_call([sys.executable, "-m", "pip", "install",
                               "openai", "--break-system-packages", "-q"])
        import openai as _openai

• Confidence: 95% confidence
• Finding: Automatically installing a package at runtime with pip expands the trust boundary to the network and package indexes during execution, creating supply-chain risk and non-deterministic behavior. The use of `--break-system-packages` further weakens environment integrity and can modify system-managed Python installations in unsafe ways.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The script uploads potentially sensitive audio content to a third-party API but does not present a clear user-facing warning, consent prompt, or data-handling notice at the point of transfer. In a transcription skill context, users may provide meetings, calls, or personal recordings, so silent transmission materially increases privacy and compliance risk.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The workflow describes sending audio chunks to OpenAI's Whisper API but does not clearly warn users that their uploaded media and derived content will be transmitted to an external service. This undermines informed consent and may expose sensitive recordings or regulated data to third-party processing unexpectedly.

Context-Inappropriate Capability

Medium

• Confidence: 93% confidence
• Finding: The skill instructs the agent to install Python packages with pip and later recommends installing ffmpeg, expanding behavior beyond simple transcription into environment modification. This increases supply-chain and system integrity risk, especially in shared or managed environments, because dependency installation may execute arbitrary package setup code or alter the runtime unexpectedly.

Context-Inappropriate Capability

Medium

• Confidence: 98% confidence
• Finding: The skill tells the agent to ask the user to paste a raw OpenAI API key directly into conversation. Collecting secrets in chat is dangerous because transcripts, logs, prompts, or downstream tooling may retain or expose the credential, enabling unauthorized API use and billing abuse.

Missing User Warnings

Medium

• Confidence: 98% confidence
• Finding: Beyond asking for an API key, the skill gives no warning about credential sensitivity, storage, or safer alternatives. This normalizes insecure secret handling and raises the likelihood that users will expose valid credentials in chat logs or to untrusted intermediaries.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

| `AuthenticationError` | Invalid API key — ask user to verify |
| `RateLimitError` | Wait 60s and retry, or use `--chunk-size 10` |
| `InvalidRequestError: file too large` | Reduce `--chunk-size` below 25 |
| `ffmpeg not found` | `sudo apt install ffmpeg` or `brew install ffmpeg` |
| `No audio stream found` | File may be corrupt or wrong format |

## Example Interaction

• Confidence: 91% confidence
• Finding: Recommending `sudo apt install ffmpeg` introduces privileged execution guidance into a skill whose purpose is transcription. Encouraging elevation to root increases the blast radius of mistakes or abuse and can lead to unauthorized system changes in environments where the agent should remain unprivileged.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

import openai as _openai
    except ImportError:
        print("Installing openai...", flush=True)
        subprocess.check_call([sys.executable, "-m", "pip", "install",
                               "openai", "--break-system-packages", "-q"])
        import openai as _openai

• Confidence: 97% confidence
• Finding: Automatically installing `openai` at runtime with pip executes code and package metadata from an external repository in the current environment, which is a supply-chain and arbitrary code execution risk. In an agent skill context, this is more dangerous because the script may run unattended with the agent user's privileges and can modify the system Python environment via `--break-system-packages`.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

def check_ffmpeg():
    """Verify ffmpeg is installed."""
    result = subprocess.run(["ffmpeg", "-version"],
                            capture_output=True, text=True)
    if result.returncode != 0:
        print("❌  ffmpeg not found. Install it:")

• Confidence: 70% confidence
• Finding: subprocess module calls execute external commands. Without careful input validation, this enables command injection.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

def check_ffmpeg():
    """Verify ffmpeg is installed."""
    result = subprocess.run(["ffmpeg", "-version"],
                            capture_output=True, text=True)
    if result.returncode != 0:
        print("❌  ffmpeg not found. Install it:")

• Confidence: 70% confidence
• Finding: subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

capture_output=True, text=True)
    if result.returncode != 0:
        print("❌  ffmpeg not found. Install it:")
        print("    Ubuntu/Debian: sudo apt install ffmpeg")
        print("    macOS:         brew install ffmpeg")
        print("    Windows:       https://ffmpeg.org/download.html")
        sys.exit(1)

• Confidence: 70% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

capture_output=True, text=True)
    if result.returncode != 0:
        print("❌  ffmpeg not found. Install it:")
        print("    Ubuntu/Debian: sudo apt install ffmpeg")
        print("    macOS:         brew install ffmpeg")
        print("    Windows:       https://ffmpeg.org/download.html")
        sys.exit(1)

• Confidence: 70% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

capture_output=True, text=True)
    if result.returncode != 0:
        print("❌  ffmpeg not found. Install it:")
        print("    Ubuntu/Debian: sudo apt install ffmpeg")
        print("    macOS:         brew install ffmpeg")
        print("    Windows:       https://ffmpeg.org/download.html")
        sys.exit(1)

• Confidence: 70% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

"-show_format",
        file_path
    ]
    result = subprocess.run(cmd, capture_output=True, text=True)
    if result.returncode != 0:
        return 0.0
    try:

• Confidence: 70% confidence
• Finding: subprocess module calls execute external commands. Without careful input validation, this enables command injection.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

"-show_format",
        file_path
    ]
    result = subprocess.run(cmd, capture_output=True, text=True)
    if result.returncode != 0:
        return 0.0
    try:

• Confidence: 70% confidence
• Finding: subprocess module calls execute external commands. Without careful input validation, this enables command injection.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

"-show_format",
        file_path
    ]
    result = subprocess.run(cmd, capture_output=True, text=True)
    if result.returncode != 0:
        return 0.0
    try:

• Confidence: 70% confidence
• Finding: subprocess module calls execute external commands. Without careful input validation, this enables command injection.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

"-show_format",
        file_path
    ]
    result = subprocess.run(cmd, capture_output=True, text=True)
    if result.returncode != 0:
        return 0.0
    try:

• Confidence: 70% confidence
• Finding: subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The script uploads user-provided audio to the OpenAI transcription API but does not present an explicit user-facing privacy warning or require confirmation before external transfer. In a transcription skill, this materially increases risk because recordings often contain sensitive personal, financial, medical, or corporate information and users may assume processing is local.

Context-Inappropriate Capability

Low

• Confidence: 78% confidence
• Finding: The manifest describes a transcription skill, but the documented workflow tells the agent to run pip installs with system-package override flags. While dependencies are implementation details, directing the agent to modify the runtime environment is a broader capability than the stated end-user purpose and is not justified in the manifest text.

Static analysis

No suspicious patterns detected.