Security audit

Whisper GPU Audio Transcriber

Security checks for vulnerabilities and agentic risk

Overview

This skill is a coherent local audio-to-subtitle tool, but users should notice the first-run network/model download, unpinned Python dependencies, and same-directory SRT writes before installing.

Install this only in an environment where first-run network downloads and pip-installed ML dependencies are acceptable. Pre-cache or verify Whisper models if you need truly offline operation, and check whether a same-name .srt already exists before running it on important media files.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

Location: SKILL.md:8
Finding: Unpinned Dependencies and Unverified Model Sources
Content: View full analysis
**Tip for China users**: If model download fails, manually download from mirror sites and place in `~/.cache/whisper/` ``` `README.md:22-38`: ```markdown ### Install Dependencies ```bash pip install openai-whisper ``` Install PyTorch matching your hardware: ```bash # Intel GPU pip install torch==2.10.0+xpu # NVIDIA GPU pip install torch --index-url https://download.pytorch.org/whl/cu121 # CPU pip install torch ``` ``` `README.md:141-145`: ```markdown - First run will auto-download the model file (turbo ~1.5GB) - Models cache in `~/.cache/whisper` by default, can use symlink/Junction to redirect - Intel XPU requires Intel Arc GPU + matching PyTorch version - China users: If model download fails, manually download from mirror sites and place in `~/.cache/whisper/` ``` ### Technical Analysis The Skill automatically installs `openai-whisper` without pinning an exact version or verif ...[truncated 2943 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (6)

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 85% confidence
Finding: The skill documentation instructs the agent to run a script that writes output subtitle files, but the manifest does not declare any tool scope or file permissions. This creates a transparency and policy-enforcement gap: an agent or runtime may perform filesystem writes beyond what users or platform controls expect, increasing the risk of unintended file modification.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill claims the transcription is offline and does not require internet, but elsewhere states that the first run automatically downloads Whisper model files. This is dangerous because users may run the skill in restricted or sensitive environments under a false assumption of no network activity, leading to unexpected outbound connections and supply-chain exposure.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The Chinese-language documentation repeats the same misleading claim that the skill works without internet, while later admitting the model is downloaded automatically on first use. In multilingual skills, inconsistent disclosure increases risk because one user group may be misled about network behavior and execute the skill in environments where outbound access is prohibited.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The script sets language="zh" in the transcribe function and also documents --language defaulting to zh 中文, which imposes a specific language/locale by default. Under the policy, forcing a specific language without explicit user opt-in is a natural-language policy concern even though the user can override it manually.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 88% confidence
Finding: This markdown file states that the skill transcribes audio and saves output in the same directory as the source audio, which is a file-writing operation. The description does not include any user warning about overwrite behavior, data impact, or the need to verify the output path before execution.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Low

Category: Not specified by scanner
Confidence: 78% confidence
Finding: The manifest description frames the skill as local transcription, but the documented behavior includes downloading large model files from the network before local processing can occur. While the runtime behavior may still be mostly local after setup, the manifest understates network dependency and can mislead users performing trust or compliance review.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.