Speechall command-line tool for fast speech-to-text transcription using multiple providers

• Outcome: Review
• Latest audit: Sep 10, 2026 · 11:09 AM UTC
• Version: 0.1.1

Overview

The skill does what it claims, but it asks users to install an unpinned third-party executable and send potentially sensitive media to external transcription services with limited disclosure.

Review Speechall and provider data-handling terms before using this with confidential, personal, regulated, or consent-sensitive recordings. Prefer a pinned release with verified checksums or signatures, install it in a user-scoped location, and avoid passing the API key on the command line when possible.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:15

Finding

Unverified Installation of an Unpinned Third-Party CLI

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 15–18
Vulnerability Type: Supply-chain risk from an unverified third-party executable
Risk Level: Medium

Vulnerable Code Snippet:

bash

brew install Speechall/tap/speechall

Without Homebrew: Download the binary for your platform from https://github.com/Speechall/speechall-cli/releases and place it on your PATH.

Technical Analysis

The installation instructions direct users to install and execute a third-party CLI through a custom Homebrew tap or by downloading a release binary. They do not specify a reviewed version, immutable artifact URL, cryptographic signature, trusted publisher identity, or expected checksum.

Because the selected release can change after this Skill has been reviewed, compromise of the Homebrew tap, source repository, release workflow, maintainer account, or hosted artifact could cause users to install attacker-controlled executable code. Placing a downloaded binary on PATH also makes it available for future invocation without further verification.

The repository contains only documentation, and no evidence establishes that the current upstream CLI or release artifacts are malicious. The vulnerability is the absence of dependency pinning and artifact-integrity controls in the documented installation process.

Attack Path

1. An attacker compromises an upstream maintainer account, release pipeline, repository, custom Homebrew tap, or hosted release artifact.
2. The attacker publishes a modified speechall package or binary under the expected project identity.
3. A user follows the documented installation command or downloads the latest platform binary without validating its version, signature, or checksum.
4. The user places the executable on PATH and runs speechall.
5. The modified executable runs with the privileges of the invoking user and can access resources available to that account.

Impac

...[truncated 638 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin the installation instructions to a specific, reviewed release version rather than implicitly using the latest available release.
2. Provide exact HTTPS download URLs for platform-specific artifacts.
3. Publish and document expected SHA-256 or stronger cryptographic checksums, and require users to verify them before installation.
4. Prefer cryptographically signed releases and document signature verification against a pinned, independently distributed maintainer public key.
5. For Homebrew installations, pin a reviewed formula revision or commit where practical and document how users can inspect the resolved formula and source URL.
6. Recommend installing the executable in a user-scoped directory with least privilege. Do not instruct users to run the installer or CLI as root unless strictly necessary.
7. Document the external trust boundary clearly, including that audio or video content and authentication credentials are processed by third-party software and services.
8. Maintain a release provenance mechanism, such as signed attestations or SLSA-compatible build provenance, so users can verify that artifacts were produced by the expected build workflow.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill explicitly routes user audio/video through the Speechall API and potentially multiple third-party providers, but it does not clearly warn users that their media content and embedded sensitive information may be transmitted off-device. This creates a real privacy and data-handling risk, especially because audio/video often contains personal, confidential, or regulated information and the skill encourages use with arbitrary files.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.