Whisper GPU Audio Transcriber

Security checks across malware telemetry and agentic risk

Overview

This skill appears to match its stated purpose: it runs a local Whisper transcription script, with normal caution needed for Python dependencies, model downloads, and generated subtitle files.

Before installing, make sure you are comfortable with Python package installation, a large first-run Whisper model download, and local creation or overwriting of .srt subtitle files. The provided code and documentation are coherent with the stated transcription purpose.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Risk analysis

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

#
ASI04: Agentic Supply Chain Vulnerabilities
Low
What this means

The first use may download a large model and requires trusting the Python packages and model source.

Why it was flagged

The skill depends on external Python packages and downloads a Whisper model on first use. This is expected for local Whisper transcription, but it means installation and first run involve third-party downloads and local disk use.

Skill content
openai-whisper: Automatically installed via `pip install openai-whisper`; First run will auto-download the model file (turbo ~1.5GB); Models cache in `~/.cache/whisper`
Recommendation

Install dependencies from trusted package indexes, verify the PyTorch/Whisper variants match your hardware, and expect the first run to use network bandwidth and disk space.

#
ASI05: Unexpected Code Execution
Info
What this means

Using the skill runs local Python code on the selected audio file.

Why it was flagged

The skill explicitly instructs the agent to run a local Python script. The provided script aligns with the transcription purpose, so this is expected rather than suspicious.

Skill content
AI will execute the `scripts/transcribe.py` script
Recommendation

Review the included script if you are cautious about local code execution, and run it only on files and directories you intend to process.

#
ASI02: Tool Misuse and Exploitation
Info
What this means

A subtitle file will be created or replaced in the audio file directory or chosen output directory.

Why it was flagged

The script creates the requested output directory if needed and writes an SRT file. This is necessary for the skill, but it may overwrite an existing same-named .srt file in the target directory.

Skill content
os.makedirs(output_dir, exist_ok=True) ... output_file = os.path.join(output_dir, f"{basename}.srt") ... open(output_file, "w", encoding="utf-8")
Recommendation

Use a dedicated output folder or back up any existing same-named SRT files if overwriting would matter.