Security audit

TL;DX

Security checks for vulnerabilities and agentic risk

Overview

The skill has a legitimate summarization/transcription purpose, but it can install system packages with sudo and build unpinned external code during runtime setup.

Review this skill before installing, especially on machines where the agent can use sudo or package managers. Prefer installing ffmpeg and whisper.cpp yourself, or run the skill in a container or restricted environment with network and package-manager access controlled. Expect it to fetch media, create local runtime files, and download transcription models when used.

A.I.G

Vulnerability Patterns

Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions

Findings (4)

T03 · Remote Payload Retrieval and Execution

Warning

Location: scripts/ensure_whisper_cpp.sh:62
Finding: Mutable Remote Source Is Retrieved, Built, and Executed
Content: View full analysis
/dev/null 2>&1 && command -v cmake >/dev/null 2>&1; then REPO_DIR="${SRC_DIR}/whisper.cpp" if [[ ! -d "${REPO_DIR}" ]]; then retry_command 5 git clone --depth=1 https://github.com/ggml-org/whisper.cpp.git "${REPO_DIR}" || true fi if [[ -d "${REPO_DIR}/.git" ]]; then retry_command 3 git -C "${REPO_DIR}" fetch --depth=1 origin || true fi if [[ -d "${REPO_DIR}" ]]; then retry_command 3 cmake -S "${REPO_DIR}" -B "${REPO_DIR}/build" -DWHISPER_BUILD_TESTS=OFF -DWHISPER_BUILD_EXAMPLES=ON >/dev/null || true retry_command 3 cmake --build "${REPO_DIR}/build" --config Release --target whisper-cli -j 4 >/dev/null || true fi ``` ### Technical Analysis The provisioning script clones the current default branch of an external GitHub repository and builds it locally. Neither the clone nor the subsequent fetch is pinned to an audited commit, immutable release tag, or cryptographically verified source archive. Because the effective source payload can change after this Skill package has been reviewed, execution is determined partly by mutable external state. CMake configuration and compilation can execute repository-controlled build logic, including CMake scripts and compiler tooling. The resulting `whisper-cli` binary is later invoked by `scripts/run_whisper_cpp.sh`. TLS protects transport in ordinary conditions but does not establish that the downloaded revision is the specific revision reviewed by the Skill author. ### Attack Path 1. An attacker compromises the upstream repository, a maintainer account, or its release workflow, or otherwise causes malicious source to appear on the fetched default branch. 2. A user invokes the bootstrap or transcription workflow on a system without a usable local `whisper-cli`. 3 ...[truncated 768 chars]
Remediation: View remediation

T05 · Unauthorized Access and Privilege Escalation

Warning

Location: scripts/ensure_ffmpeg.sh:4
Finding: Automatic FFmpeg Provisioning Can Modify the Host with Elevated Privileges
Content: View full analysis
/dev/null 2>&1; then sudo "$@" return fi "$@" } ``` ```bash if command -v apt-get >/dev/null 2>&1; then retry_command 3 run_with_optional_sudo apt-get update || true retry_command 3 run_with_optional_sudo apt-get install -y ffmpeg || true if command -v ffmpeg >/dev/null 2>&1; then command -v ffmpeg exit 0 fi fi if command -v dnf >/dev/null 2>&1; then retry_command 3 run_with_optional_sudo dnf install -y ffmpeg || true if command -v ffmpeg >/dev/null 2>&1; then command -v ffmpeg exit 0 fi fi if command -v yum >/dev/null 2>&1; then retry_command 3 run_with_optional_sudo yum install -y ffmpeg || true if command -v ffmpeg >/dev/null 2>&1; then command -v ffmpeg exit 0 fi fi if command -v pacman >/dev/null 2>&1; then retry_command 3 run_with_optional_sudo pacman -Sy --noconfirm ffmpeg || true if command -v ffmpeg >/dev/null 2>&1; then command -v ffmpeg exit 0 fi fi ``` The bootstrap invokes this installation path while suppressing normal output: ```bash bash "${SCRIPT_DIR}/ensure_ffmpeg.sh" >/dev/null ``` ### Technical Analysis When FFmpeg is unavailable, the Skill automatically selects a host package manager and invokes it through `sudo` whenever `sudo` is installed. Package index updates and noninteractive package installations are system-wide operations that cross the least-privilege boundary of a local transcription Skill. The installation is functionally related to media processing, but acquiring root privileges and changing host package state should not occur implicitly during routine Skill execution. Pac ...[truncated 1510 chars]
Remediation: View remediation

T08 · Insecure Dependencies

Note

Location: scripts/ensure_whisper_model.sh:12
Finding: Whisper Model Downloads Are Not Cryptographically Verified
Content: View full analysis
&2 sleep "${delay}" if [[ "${delay}" -lt 30 ]]; then delay=$((delay * 2)) fi fi done rm -f "${partial}" return 1 } ``` ```bash case "${MODEL_NAME}" in tiny|base|small|medium|large-v3|large-v3-turbo) URL="https://huggingface.co/ggerganov/whisper.cpp/resolve/main/ggml-${MODEL_NAME}.bin" ;; *) echo "Unsupported model name: ${MODEL_NAME}" >&2 exit 1 ;; esac retry_download "${URL}" "${TARGET}" 10 || { echo "Failed to download ggml-${MODEL_NAME}.bin after multiple attempts." >&2 exit 1 } ``` ### Technical Analysis The model is downloaded from a URL containing the mutable `main` revision. The only content validation is that the downloaded file exceeds 100,000,000 bytes. File size is not a cryptographic integrity or authenticity control and can be trivially reproduced by a substituted artifact. Although the model is data rather than a directly executed shell program, it is parsed by native Whisper.cpp code. A malicious model could produce manipulated transcription results, cause denial of service, or exercise vulnerabilities in the native model loader. HTTPS reduces ordinary network tampering but does not protect against ...[truncated 1044 chars]
Remediation: View remediation

T05 · Unauthorized Access and Privilege Escalation

Note

Location: SKILL.md:58
Finding: Optional Persistent Memory Access Exceeds the Minimum Summarization Scope
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults

Findings (28)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The declared description says this skill processes long-form media/text content via extraction, Whisper transcription, transcript cleaning, speaker segmentation, and summarization. The actual code chunk does none of those things. Instead, it is an operational maintenance script for cleaning the skill's runtime directories and removing cached files or model binaries. This is a materially different primary purpose and introduces undeclared destructive filesystem capabilities. Therefore the description does not accurately represent the behavior of the supplied code chunk.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The declared purpose focuses on processing long-form content: extraction, Whisper transcription, transcript cleaning, segmentation, and analysis. The actual code chunk does none of these. Instead, it manages local runtime storage by measuring directory sizes, printing warnings, and invoking a cleanup script when thresholds are exceeded or when forced. This is a materially different primary purpose and an undeclared filesystem-maintenance capability, so the description does not accurately represent this code chunk.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The declared purpose centers on content ingestion and analysis workflows such as extraction, Whisper transcription, transcript cleanup, speaker segmentation, and summarization. The actual code does none of these tasks. Instead, it inspects local directories under a runtime folder, calculates disk usage, counts files, and lists model binaries. That is an operational/diagnostic utility, not a media/text processing implementation detail tied to the declared end-user functionality. Therefore the code chunk's purpose is materially different from the declared description.
Content: No source excerpt is available for this finding.

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 380)May include surrounding context.
md
- `SKILL.md`

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 94% confidence
Finding: The --noconfirm parameter disables interactive safeguards for pacman, allowing package installation to proceed without user validation. This is dangerous in an agent skill because it facilitates unattended host modification and can mask unintended or inappropriate package operations.
Content: Scanner excerpt · scripts/ensure_ffmpeg.sh (reported line 80)May include surrounding context.
sh
fi if command -v pacman >/dev/null 2>&1; then retry_command 3 run_with_optional_sudo pacman -Sy --noconfirm ffmpeg || true if command -v ffmpeg >/dev/null 2>&1; then command -v ffmpeg exit 0

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 85% confidence
Finding: The skill explicitly directs the agent to use shell-backed scripts in scripts/ and manage a local runtime, but it declares no permissions or allowed-tools scope. That creates an overbroad execution surface where callers and reviewers cannot easily tell which tool capabilities are required, increasing the chance of unintended command execution or misuse of shell access.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The text says 'especially in Chinese, prefer an editorial long-form shape' and then prescribes Chinese section headings such as '总摘要'. This is a natural-language locale policy concern because it steers output toward a specific language/locale convention without explicitly requiring user choice or opt-in in this file.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The article URL invocation guidance is broad enough that an assistant could trigger the skill whenever a user merely shares a link, even if the user did not clearly request extraction or summarization. That can cause unintended remote content retrieval and processing, which is risky in a skill specifically designed to ingest external URLs and transform their contents.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The video/podcast trigger is similarly overbroad and can lead to automatic fetching of captions or acquisition of media from user-provided links without a clearly scoped request. Because this skill may download or transcribe long-form media, accidental invocation increases privacy, bandwidth, and consent risks beyond ordinary summarization.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The guidance tells the assistant to acquire media and transcribe it when captions are unavailable, but it does not require warning the user that external content may be downloaded and processed. In a media-ingestion skill, this omission is material because users may not realize the workflow involves retrieval, storage, and potentially costly or privacy-sensitive transcription operations.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: Forcing the output to include the Chinese label '总摘要' without user opt-in can override user expectations and reduce fidelity to the user's requested language or format. While not a direct security exploit, it is a prompt-quality and control issue that can cause unintended behavior and weaken user intent preservation.
Content: No source excerpt is available for this finding.

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 90% confidence
Finding: The helper function is explicitly designed to execute arbitrary passed commands via sudo when available, enabling privileged operations during normal script flow. While intended for dependency setup, embedding privilege escalation in a content-processing skill increases risk if the script is triggered unexpectedly or chained with other issues.
Content: Scanner excerpt · scripts/ensure_ffmpeg.sh (reported line 10)May include surrounding context.
sh
return fi if command -v sudo >/dev/null 2>&1; then sudo "$@" return fi

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 90% confidence
Finding: This sudo execution path is part of an automatic privilege escalation helper, allowing the script to run system-modifying commands as root when available. Even without overtly malicious behavior, this is dangerous because it normalizes elevated execution inside a summarization workflow and broadens the impact of mistakes or downstream compromise.
Content: Scanner excerpt · scripts/ensure_ffmpeg.sh (reported line 11)May include surrounding context.
sh
fi if command -v sudo >/dev/null 2>&1; then sudo "$@" return fi

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: This code modifies the host environment by installing software when ffmpeg is absent, but that behavior is not reflected in the user-facing skill description. Hidden environment changes are risky because users may expect summarization functionality, not package installation with possible root privileges.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The script attempts package installation and privileged system modification without an explicit warning, confirmation, or consent flow. This is dangerous because the skill may unexpectedly trigger administrative actions on a user's machine, including package database updates and new software installation.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The script goes beyond checking for a local dependency and actively performs system-level package management across multiple package managers, potentially with elevated privileges. In the context of a summarization skill, this expands the trust boundary and can unexpectedly alter the host system, increasing operational and supply-chain risk if invoked automatically.
Content: No source excerpt is available for this finding.

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 94% confidence
Finding: The apt-get update command may be executed through sudo, causing privileged modification of package metadata on the host. Although common in setup scripts, it is not necessary for core summarization logic and creates unexpected administrative side effects for users of this skill.
Content: Scanner excerpt · scripts/ensure_ffmpeg.sh (reported line 55)May include surrounding context.
sh
fi if command -v apt-get >/dev/null 2>&1; then retry_command 3 run_with_optional_sudo apt-get update || true retry_command 3 run_with_optional_sudo apt-get install -y ffmpeg || true if command -v ffmpeg >/dev/null 2>&1; then command -v ffmpeg

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 95% confidence
Finding: This line can install ffmpeg via apt-get with elevated privileges, directly changing the host system state. In the context of a user-facing summarization tool, automatic root-level package installation is excessive and can lead to unreviewed software changes or compliance issues.
Content: Scanner excerpt · scripts/ensure_ffmpeg.sh (reported line 56)May include surrounding context.
sh
if command -v apt-get >/dev/null 2>&1; then retry_command 3 run_with_optional_sudo apt-get update || true retry_command 3 run_with_optional_sudo apt-get install -y ffmpeg || true if command -v ffmpeg >/dev/null 2>&1; then command -v ffmpeg exit 0

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 93% confidence
Finding: The script can invoke dnf install through sudo, enabling privileged package installation on Fedora-like systems. This widens the attack surface and operational impact of the skill because a text/media summarization action can unexpectedly alter system packages.
Content: Scanner excerpt · scripts/ensure_ffmpeg.sh (reported line 64)May include surrounding context.
sh
fi if command -v dnf >/dev/null 2>&1; then retry_command 3 run_with_optional_sudo dnf install -y ffmpeg || true if command -v ffmpeg >/dev/null 2>&1; then command -v ffmpeg exit 0

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 93% confidence
Finding: The yum installation path allows root-level package installation as part of normal execution. That is risky because it couples content-processing functionality with privileged host modification, which is unnecessary for many deployments and can surprise users.
Content: Scanner excerpt · scripts/ensure_ffmpeg.sh (reported line 72)May include surrounding context.
sh
fi if command -v yum >/dev/null 2>&1; then retry_command 3 run_with_optional_sudo yum install -y ffmpeg || true if command -v ffmpeg >/dev/null 2>&1; then command -v ffmpeg exit 0

Autonomous Decision Making

Medium

Category: Excessive Agency
Confidence: 92% confidence
Finding: Using pacman with --noconfirm suppresses interactive review and approval, allowing the script to make package management decisions autonomously. In a skill context, this increases the chance of unintended system changes and reduces the user's ability to notice or stop risky actions.
Content: Scanner excerpt · scripts/ensure_ffmpeg.sh (reported line 80)May include surrounding context.
sh
fi if command -v pacman >/dev/null 2>&1; then retry_command 3 run_with_optional_sudo pacman -Sy --noconfirm ffmpeg || true if command -v ffmpeg >/dev/null 2>&1; then command -v ffmpeg exit 0

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 95% confidence
Finding: This pacman command combines sudo-capable execution with --noconfirm, enabling unattended privileged package installation. That combination is particularly risky because it minimizes user visibility and control over system changes triggered by a summarization skill.
Content: Scanner excerpt · scripts/ensure_ffmpeg.sh (reported line 80)May include surrounding context.
sh
fi if command -v pacman >/dev/null 2>&1; then retry_command 3 run_with_optional_sudo pacman -Sy --noconfirm ffmpeg || true if command -v ffmpeg >/dev/null 2>&1; then command -v ffmpeg exit 0

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The script automatically installs software via Homebrew, clones code from GitHub, and builds a binary from source at runtime. That expands the skill's behavior from content processing into environment modification and execution of externally fetched code, creating supply-chain and user-consent risks if the remote package or repository is compromised or unexpected installation occurs.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The script performs silent network-backed provisioning and compilation without an explicit warning at the point of use. In a skill meant for summarization/transcription, this is riskier because users may not expect package installation, source retrieval, or build execution on their machine, reducing informed consent and increasing exposure to supply-chain compromise.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The script sets LANGUAGE to zh by default, which imposes a specific language/locale behavior when the caller does not provide an explicit choice. This is a natural-language policy concern because the file does not offer opt-in messaging or justification for restricting output/transcription language to Chinese by default.
Content: No source excerpt is available for this finding.