audio to text and video to text

• Outcome: Review
• Latest audit: Sep 12, 2026 · 5:19 AM UTC
• Version: 1.0.0

Overview

The skill performs a coherent transcription workflow, but it asks for raw API keys in chat and can modify the Python environment at runtime with unpinned installs.

Review before installing. Use this only for media you are comfortable sending to OpenAI for transcription, configure the API key through a secure environment or secret mechanism rather than chat or --api-key, and avoid letting the skill install packages at runtime or use sudo on your behalf. Prefer a managed environment with preinstalled, pinned dependencies and ffmpeg already available.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: scripts/transcribe.py:61

Finding

Unpinned Dependency Installation at Runtime

Content

View full analysis

Remediation

View remediation

--hash=sha256: ``` 4. Install dependencies during a controlled build or setup phase rather than when processing user media. 5. Use an isolated virtual environment or container and remove `--break-system-packages`. 6. Restrict installation to a trusted package index and validate the configured pip index. 7. Generate and review a software bill of materials and periodically scan dependencies for known vulnerabilities. 8. Remove `pydub` from the installation instructions unless the implementation actually requires it. 9. Apply least privilege and prevent the transcription process from writing to shared package or system directories. ]]>

T09 · Insecure Skill Coding Practices

Note

• Location: scripts/transcribe.py:39

Finding

OpenAI API Key Exposed Through Command-Line Arguments

Content

View full analysis

") print(" Get a key at: https://platform.openai.com/api-keys") sys.exit(1) _openai.api_key = key ``` The documented Quick Start encourages this invocation pattern: ```bash python /home/claude/transcription/scripts/transcribe.py \ --input "/path/to/media/file" \ --output "/mnt/user-data/outputs/transcript.txt" \ --api-key "$OPENAI_API_KEY" ``` Although the shell expression references an environment variable, the shell expands it before starting Python. The resulting process argument vector therefore contains the plaintext API key. ### Technical Analysis Command-line arguments may be exposed through process-inspection interfaces, diagnostic tooling, job schedulers, monitoring agents, crash reports, audit logs, shell tracing, or orchestration metadata. Exposure depends on operating-system permissions and deployment configuration; it is not necessarily available to every unprivileged user. The implementation does not print the key itself, and no hardcoded credential was found. The weakness is that the supported and documented CLI interface creates an avoidable plaintext copy of the cr ...[truncated 1578 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import

Findings (24)

Vague Triggers

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The trigger guidance is overly broad, including catch-all conditions like using the skill whenever there is uncertainty or whenever a media file is referenced. Overbroad activation can cause the agent to route unrelated requests into a workflow that accesses local files and sends user media to an external API without sufficiently specific user intent.

Content

No source excerpt is available for this finding.

Vague Triggers

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The trigger guidance is overly broad, including catch-all conditions like using the skill whenever unsure whether transcription is involved. This can cause the agent to invoke the skill in contexts where external processing, file handling, or API use was not clearly intended by the user, increasing the chance of improper data disclosure or unnecessary execution.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 94% confidence

Finding

The skill invokes shell commands, accesses environment variables, and writes files, but it does not declare any explicit tool scope or permission boundaries. This increases the chance an agent will execute privileged actions implicitly, reducing auditability and making misuse or overreach harder to contain.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The skill describes sending audio chunks to OpenAI's Whisper API but does not clearly warn users that their media content will be transmitted to an external service. This creates a privacy and consent risk, particularly for sensitive meetings, recordings, or regulated data.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The skill tells the agent to request a raw OpenAI API key from the user, creating a credential collection flow not safely bounded by the platform. Asking for secrets in-band increases the risk of accidental retention, logging, reuse, or exfiltration, especially because the skill also uses shell and environment access.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 95% confidence

Finding

Automatically installing a package at runtime with pip expands the trust boundary to the network and package indexes during execution, creating supply-chain risk and non-deterministic behavior. The use of --break-system-packages further weakens environment integrity and can modify system-managed Python installations in unsafe ways.

Content

Scanner excerpt · scripts/transcribe.py (reported line 73)May include surrounding context.

python

import openai as _openai
    except ImportError:
        print("Installing openai...", flush=True)
        subprocess.check_call([sys.executable, "-m", "pip", "install",
                               "openai", "--break-system-packages", "-q"])
        import openai as _openai

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The script uploads potentially sensitive audio content to a third-party API but does not present a clear user-facing warning, consent prompt, or data-handling notice at the point of transfer. In a transcription skill context, users may provide meetings, calls, or personal recordings, so silent transmission materially increases privacy and compliance risk.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The workflow describes sending audio chunks to OpenAI's Whisper API but does not clearly warn users that their uploaded media and derived content will be transmitted to an external service. This undermines informed consent and may expose sensitive recordings or regulated data to third-party processing unexpectedly.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill instructs the agent to install Python packages with pip and later recommends installing ffmpeg, expanding behavior beyond simple transcription into environment modification. This increases supply-chain and system integrity risk, especially in shared or managed environments, because dependency installation may execute arbitrary package setup code or alter the runtime unexpectedly.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The skill tells the agent to ask the user to paste a raw OpenAI API key directly into conversation. Collecting secrets in chat is dangerous because transcripts, logs, prompts, or downstream tooling may retain or expose the credential, enabling unauthorized API use and billing abuse.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

Beyond asking for an API key, the skill gives no warning about credential sensitivity, storage, or safer alternatives. This normalizes insecure secret handling and raises the likelihood that users will expose valid credentials in chat logs or to untrusted intermediaries.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 91% confidence

Finding

Recommending sudo apt install ffmpeg introduces privileged execution guidance into a skill whose purpose is transcription. Encouraging elevation to root increases the blast radius of mistakes or abuse and can lead to unauthorized system changes in environments where the agent should remain unprivileged.

Content

Scanner excerpt · transcription/SKILL.md (reported line 129)May include surrounding context.

md

| `AuthenticationError` | Invalid API key — ask user to verify |
| `RateLimitError` | Wait 60s and retry, or use `--chunk-size 10` |
| `InvalidRequestError: file too large` | Reduce `--chunk-size` below 25 |
| `ffmpeg not found` | `sudo apt install ffmpeg` or `brew install ffmpeg` |
| `No audio stream found` | File may be corrupt or wrong format |

## Example Interaction

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 97% confidence

Finding

Automatically installing openai at runtime with pip executes code and package metadata from an external repository in the current environment, which is a supply-chain and arbitrary code execution risk. In an agent skill context, this is more dangerous because the script may run unattended with the agent user's privileges and can modify the system Python environment via --break-system-packages.

Content

Scanner excerpt · transcription/scripts/transcribe.py (reported line 73)May include surrounding context.

python

import openai as _openai
    except ImportError:
        print("Installing openai...", flush=True)
        subprocess.check_call([sys.executable, "-m", "pip", "install",
                               "openai", "--break-system-packages", "-q"])
        import openai as _openai

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/transcribe.py (reported line 90)May include surrounding context.

python

def check_ffmpeg():
    """Verify ffmpeg is installed."""
    result = subprocess.run(["ffmpeg", "-version"],
                            capture_output=True, text=True)
    if result.returncode != 0:
        print("❌  ffmpeg not found. Install it:")

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · transcription/scripts/transcribe.py (reported line 90)May include surrounding context.

python

def check_ffmpeg():
    """Verify ffmpeg is installed."""
    result = subprocess.run(["ffmpeg", "-version"],
                            capture_output=True, text=True)
    if result.returncode != 0:
        print("❌  ffmpeg not found. Install it:")

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 129)May include surrounding context.

md

capture_output=True, text=True)
    if result.returncode != 0:
        print("❌  ffmpeg not found. Install it:")
        print("    Ubuntu/Debian: sudo apt install ffmpeg")
        print("    macOS:         brew install ffmpeg")
        print("    Windows:       https://ffmpeg.org/download.html")
        sys.exit(1)

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · scripts/transcribe.py (reported line 94)May include surrounding context.

python

capture_output=True, text=True)
    if result.returncode != 0:
        print("❌  ffmpeg not found. Install it:")
        print("    Ubuntu/Debian: sudo apt install ffmpeg")
        print("    macOS:         brew install ffmpeg")
        print("    Windows:       https://ffmpeg.org/download.html")
        sys.exit(1)

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · transcription/scripts/transcribe.py (reported line 94)May include surrounding context.

python

capture_output=True, text=True)
    if result.returncode != 0:
        print("❌  ffmpeg not found. Install it:")
        print("    Ubuntu/Debian: sudo apt install ffmpeg")
        print("    macOS:         brew install ffmpeg")
        print("    Windows:       https://ffmpeg.org/download.html")
        sys.exit(1)

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/transcribe.py (reported line 108)May include surrounding context.

python

"-show_format",
        file_path
    ]
    result = subprocess.run(cmd, capture_output=True, text=True)
    if result.returncode != 0:
        return 0.0
    try:

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/transcribe.py (reported line 139)May include surrounding context.

python

"-show_format",
        file_path
    ]
    result = subprocess.run(cmd, capture_output=True, text=True)
    if result.returncode != 0:
        return 0.0
    try:

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · transcription/scripts/transcribe.py (reported line 108)May include surrounding context.

python

"-show_format",
        file_path
    ]
    result = subprocess.run(cmd, capture_output=True, text=True)
    if result.returncode != 0:
        return 0.0
    try:

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · transcription/scripts/transcribe.py (reported line 139)May include surrounding context.

python

"-show_format",
        file_path
    ]
    result = subprocess.run(cmd, capture_output=True, text=True)
    if result.returncode != 0:
        return 0.0
    try:

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The script uploads user-provided audio to the OpenAI transcription API but does not present an explicit user-facing privacy warning or require confirmation before external transfer. In a transcription skill, this materially increases risk because recordings often contain sensitive personal, financial, medical, or corporate information and users may assume processing is local.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Low

• Category: Not specified by scanner
• Confidence: 78% confidence

Finding

The manifest describes a transcription skill, but the documented workflow tells the agent to run pip installs with system-package override flags. While dependencies are implementation details, directing the agent to modify the runtime environment is a broader capability than the stated end-user purpose and is not justified in the manifest text.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.