Security audit

Speechmatics

Security checks for vulnerabilities and agentic risk

Overview

The skill has a coherent transcription purpose, but its script exposes sensitive audio and API credentials through under-scoped endpoint controls and has a confirmed command-execution weakness.

Review this skill carefully before installing. Use it only with recordings you are allowed to send to Speechmatics, keep the API endpoint fixed to the official HTTPS service or a trusted proxy, and do not allow untrusted prompts or users to choose --base-url, SPEECHMATICS_BASE_URL, --timeout, or polling values until the script is hardened.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Error

Location: scripts/transcribe.sh:102
Finding: Unrestricted API Base URL Enables Credential and Audio Exfiltration
Content: View full analysis
"$out" ``` ### Technical Analysis The script permits the API destination to be changed through either the `SPEECHMATICS_BASE_URL` environment variable or the `--base-url` command-line option. It does not validate the URL scheme, hostname, port, or resolved network address before transmitting sensitive data. The submission request sends both of the following to the configured destination: - The Speechmatics API key in an `Authorization: Bearer` header. - The complete user-selected audio file as multipart form data. Consequently, an attacker who can influence script arguments or the execution environment can redirect the request to an attacker-controlled server. The script also permits cleartext HTTP destinations, allowing credentials and audio content to be exposed to network observers. Because arbitrary destinations are accepted, the functionality may also be used to send requests to services reachable from the host running the Skill. This creates an SSRF-like capability, although interaction is constrained to the request formats generated by ...[truncated 1382 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: scripts/transcribe.sh:133
Finding: Command Injection Through Unvalidated Bash Arithmetic Input
Content: View full analysis
timeout_seconds )); then echo "Timeout waiting for job $job_id (status=$status, waited=${timeout_seconds}s)" >&2 exit 1 fi ``` A related unvalidated value is passed to `sleep`: ```bash --poll-interval) poll_interval="${2:-}"; shift 2 ;; ``` ```bash sleep "$poll_interval" ``` The confirmed command-injection concern is the arithmetic evaluation of `timeout_seconds`. ### Technical Analysis Bash arithmetic contexts do not treat variable contents strictly as decimal integer data. Values can be recursively interpreted as arithmetic expressions and may contain variable references and array subscript expressions. Malicious arithmetic syntax can therefore trigger additional shell evaluation, including command substitution through crafted array-subscript constructs. Quoting the value when assigning it does not make later arithmetic evaluation safe. The expression: ```bash (( now - started > timeout_seconds )) ``` expects a numeric timeout but receives arbitrary command-line text. If an untrusted caller can control `--timeout`, the value can be constructed as a valid arithmetic expression with side effects. The vulnerable arithmetic check is reached after a transcription job has been submitted and while its status is being polled. An attacker may use a controlled API endpoint to return a valid job identifier and a continuously running status, ensuring execution reaches the vulnerable condition. ### Attack Path 1. The attacker gains control over arguments passed to `transcribe.sh` ...[truncated 1231 chars]
Remediation: View remediation
&2 exit 2 fi if [[ ! "$poll_interval" =~ ^[0-9]+$ ]] || (( 10#$poll_interval <= 0 )); then echo "Invalid --poll-interval: expected a positive integer" >&2 exit 2 fi ``` Additional hardening should include: 1. Apply reasonable upper and lower bounds to both values to prevent denial of service through extremely long or rapid polling. 2. Perform validation immediately after argument parsing and before making any network requests. 3. Normalize validated values using base-10 conversion before later arithmetic use. 4. Validate that every option requiring a value actually has a following argument, rather than allowing an empty string to propagate. 5. Add automated negative tests covering arithmetic operators, variable references, array syntax, command substitutions, whitespace, signs, decimals, and oversized numeric values. ]]>

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (4)

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 92% confidence
Finding: The skill advertises and documents execution of a shell script but does not declare any explicit tool scope or allowed-tools boundary. In agent systems, missing permission declarations can cause overbroad execution authority or unclear review expectations, increasing the chance that shell access is granted more broadly than intended.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The skill sends user-provided audio to Speechmatics' external API, but the description and usage guidance do not prominently warn users that their files leave the local environment. This creates a privacy and consent risk because users may provide sensitive voice notes, meetings, or recordings without understanding that third-party processing and retention policies apply.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The script uploads the provided audio file to a third-party Speechmatics API, which can expose sensitive voice content or embedded personal data if users are not clearly informed that the file leaves the local environment. In a transcription skill, remote upload is expected behavior, but the absence of an explicit warning/consent mechanism still creates a real privacy and data-handling risk, especially for confidential recordings.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 86% confidence
Finding: The natural-language setting is hard-coded to en unless the caller overrides it. This imposes a specific language default rather than asking the user to choose or documenting a justified locale constraint.
Content: No source excerpt is available for this finding.

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: SKILL.md:78