Security audit

Podcast Transcribe

Security checks for vulnerabilities and agentic risk

Overview

The skill is coherent for podcast transcription, but it relies on mutable command-line package execution and lacks enough safeguards around shell inputs, cloud audio upload, and fetched page content.

Install only if you are comfortable with an agent running the `podcast-helper` CLI and possibly using hosted transcription providers. Prefer a pinned, reviewed package version or local executable, avoid printing API keys, quote or validate all user-supplied paths and URLs, and require explicit consent before sending local audio to a cloud provider.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (5)

T08 · Insecure Dependencies

Error

Location: SKILL.md:14
Finding: Unpinned Third-Party Packages Are Downloaded and Executed
Content: View full analysis
/`. 2. Run `npx podcast-helper transcribe --output-dir --json`. ``` ```bash npx podcast-helper transcribe --output-dir ./out/ --json ``` ```bash npx podcast-helper transcribe --engine mlx-whisper --output-dir ./out/ --json ``` Additional unpinned installation commands include: ```bash npx skills add dairui1/podcast-helper --skill transcribe npx skills add dairui1/podcast-helper --skill transcribe -g pip install yt-dlp ``` ### Technical Analysis The documented default invokes packages through `npx` without an exact version or integrity constraint. When the package is not already available locally, `npx` can retrieve and execute the currently published package from the configured registry. The installation instructions similarly retrieve mutable package or repository references without a commit, release version, checksum, or signature. Consequently, the reviewed Skill does not fully determine the code that will execute at invocation time. A future compromised release, registry-account takeover, malicious transitive dependency, or unexpected package-resolution change could introduce arbitrary executable behavior after this Skill has been audited. ### Attack Path 1. An attacker compromises the publisher account, package registry entry, source repository, or a transitive dependency referenced by one of the unpinned packages. 2. The attacker publishes a malicious release under the expected package name or modifies the mutable installation source. 3. A user or agent follows the Skill and runs an u ...[truncated 819 chars]
Remediation: View remediation
`. 2. Use a lockfile with integrity hashes for repository-local installations. 3. Pin source-based Skill installation to an immutable commit or signed release rather than a mutable repository reference. 4. Verify package provenance, signatures, checksums, maintainer identity, and registry namespace before execution. 5. Prefer an already reviewed repository-local executable over downloading code during routine transcription. 6. Disable or restrict lifecycle scripts where package-manager functionality permits. 7. Execute third-party tools in a sandbox with minimal filesystem access, a restricted environment, and limited network access. 8. Document the exact supported versions and establish a controlled dependency-update and re-audit process. ]]>

T09 · Insecure Skill Coding Practices

Error

Location: SKILL.md:36
Finding: Unquoted User-Controlled Values Can Be Interpreted as Shell Syntax
Content: View full analysis
--output-dir ./out/ --json ``` Fallbacks: - `pnpm dlx podcast-helper transcribe --output-dir ./out/ --json` - `podcast-helper transcribe --output-dir ./out/ --json` - `node dist/cli.js transcribe --output-dir ./out/ --json` only inside this repository ``` ```markdown 1. Fetch episode context with `curl https://r.jina.ai/`. ``` The cleanup reference repeats the unsafe construction: ```bash curl https://r.jina.ai/ ``` ### Technical Analysis The Skill instructs an agent to substitute user-provided inputs, podcast URLs, output directories, and generated slugs directly into Bash command strings. The placeholders are not quoted, validated, or passed through an argument-array execution interface. If an implementation performs literal textual substitution, shell metacharacters such as command separators, command substitutions, redirections, pipes, or whitespace can change the command structure. URL query strings may also contain characters such as `&` that have shell meaning even when the input is not intentionally malicious. The prefixed Jina Reader URL does not eliminate this issue because the attacker-controlled podcast URL remains part of the shell token. Shell parsing occurs before `curl` receives the argument. ### Attack Path 1. An attacker supplies a podcast URL, local-file value, output path, or requested slug containing shell metacharacters. 2. The agent substitutes that value into one of the documented command templates. 3. The agent submits the resulting string to Bash. 4. Bash parses the injected characters as shell syntax rather than as p ...[truncated 862 chars]
Remediation: View remediation

T01 · Skill Instruction Hijacking

Error

Location: SKILL.md:56
Finding: Untrusted Episode Pages Are Introduced into Agent Context Without Prompt-Injection Isolation
Content: View full analysis
`. 2. Use the page as reference context for obvious ASR repairs, especially names and proper nouns. 3. Do not summarize, invent missing content, or overwrite the raw transcript. 4. Write a sibling `*.cleaned.txt` file. ``` The referenced cleanup workflow states: ```markdown ## Context Fetch Fetch the episode page through Jina Reader: ```bash curl https://r.jina.ai/ ``` ## Editing Rules Use the page content as reference context to: - fix obvious homophone and ASR mistakes - recover names, products, titles, and other proper nouns - remove clearly redundant filler words and repetitions - normalize punctuation and paragraph breaks for readability ``` ### Technical Analysis Podcast-page content is controlled by the page publisher and can contain arbitrary text. Passing the fetched page into the model as “reference context” creates an indirect prompt-injection boundary: malicious page text may impersonate system instructions, request additional tool calls, direct the model to expose data, or alter the requested transcript. The Skill does not explicitly classify fetched content as untrusted data, delimit it from operational instructions, prohibit following directives contained in the page, or restrict extraction to a narrow metadata schema. The existing instructions not to invent or summarize content reduce accidental editing errors but do not address adversarial instructions embedded in the fetched material. ### Attack Path 1. An attacker controls or compromises a podcast episode page. 2. The attacker inserts text designed ...[truncated 1017 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: references/inputs-and-engines.md:58
Finding: Diagnostic Command Prints a Complete Provider API Key
Content: View full analysis
Remediation: View remediation

other

Warning

Location: references/inputs-and-engines.md:27
Finding: Automatic Engine Selection May Upload Local Audio Without Explicit Provider Consent
Content: View full analysis
` only when the user explicitly wants a backend or when offline local transcription is required. ``` The primary Skill reinforces automatic selection: ```markdown - Let the CLI auto-select the engine unless the user explicitly requests a backend or needs offline Apple Silicon transcription. ``` ### Technical Analysis The Skill supports local audio files but recommends automatic engine selection. If the local engine is unavailable and one or more provider API keys exist in the environment, the documented selection order permits a hosted provider to be chosen. The instructions do not require the agent to identify the selected provider or obtain explicit consent before transmitting local audio. The mere presence of an API key does not establish that the user intends every local recording to be disclosed to that provider. This creates a privacy-boundary ambiguity, particularly for interviews, meetings, unpublished media, or regulated recordings. ### Attack Path 1. A user supplies a local audio file for transcription. 2. The local `mlx- ...[truncated 829 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Rogue AgentSelf-Modification, Session Persistence
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (16)

Env Variable Harvesting

High

Category: Data Exfiltration
Confidence: 70% confidence
Finding: Code enumerates, copies, or searches environment variables for secrets. Bulk environment access can collect credentials unrelated to the skill's stated purpose.
Content: Scanner excerpt · references/inputs-and-engines.md (reported line 61)May include surrounding context.
Quick environment check:

bash
printenv ELEVENLABS_API_KEY podcast-helper doctor

Rp1

Medium

Category: MCP Rug Pull
Confidence: 99% confidence
Finding: The manifest-level tool allowance includes Bash(npx podcast-helper:*), which authorizes an unpinned remote package execution pattern across the skill. In agent systems, manifest permissions are especially sensitive because they define what commands may be executed automatically; allowing npx against an unpinned package materially raises the chance of arbitrary code execution via upstream package compromise.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 98% confidence
Finding: The skill manifest explicitly allows execution of npx podcast-helper:* without pinning a package version, which means each invocation may fetch and execute whatever code is currently published under that name. In an agent context, this creates a supply-chain execution risk: a compromised maintainer account, typosquat, or malicious new release could lead to arbitrary code execution through a tool path the skill normalizes as acceptable.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 97% confidence
Finding: The workflow instructs the agent to run npx podcast-helper transcribe ... without a version pin, causing dynamic retrieval and execution of remote package code at runtime. Because this skill is specifically designed to process untrusted external URLs and files, the repeated encouragement to use an unpinned remote executable increases exposure to supply-chain compromise.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 97% confidence
Finding: The command example again promotes npx podcast-helper without version locking, reinforcing a pattern of non-deterministic remote code execution. Repetition in usage examples matters because operators and agents often copy the shown default verbatim, making exploitation more likely if the upstream package is ever compromised.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 97% confidence
Finding: The offline Apple Silicon example still relies on npx podcast-helper without an exact version, so even alternative execution branches retain the same supply-chain risk. This broadens the attack surface because users seeking a special-case workflow may still be instructed to run unreviewed current package code from the registry.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The documentation explicitly encourages automatic selection among multiple cloud transcription providers based on available API keys, but it does not warn that audio files, podcast content, and potentially sensitive transcript data may be transmitted to third-party services. In a transcription skill, users may reasonably assume processing is local unless told otherwise, so the omission creates a real privacy and data-handling risk rather than a purely informational issue.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 96% confidence
Finding: The documentation instructs use of npx podcast-helper without a pinned package version, which allows whatever version is current in the registry at execution time to be fetched and run. In an agent skill context, this creates a supply-chain risk: a compromised maintainer account, malicious update, typosquat resolution, or unexpected breaking release could lead to arbitrary code execution when the command is invoked.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 70% confidence
Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 70% confidence
Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
Content: No source excerpt is available for this finding.

Skill Enumeration

Medium

Category: Agent Snooping
Confidence: 85% confidence
Finding: Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
Content: Scanner excerpt · references/setup.md (reported line 22)May include surrounding context.
Manual install from a local checkout:

bash
mkdir -p ~/.claude/skills cp -R skills/transcribe ~/.claude/skills/transcribe

Session Persistence

Medium

Category: Rogue Agent
Confidence: 60% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · references/setup.md (reported line 22)May include surrounding context.
Manual install from a local checkout:

bash
mkdir -p ~/.claude/skills cp -R skills/transcribe ~/.claude/skills/transcribe

Session Persistence

Medium

Category: Rogue Agent
Confidence: 60% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · references/setup.md (reported line 57)May include surrounding context.
Manual install from a local checkout:

bash
mkdir -p ~/.openclaw/skills cp -R skills/transcribe ~/.openclaw/skills/transcribe

Rp1

Medium

Category: MCP Rug Pull
Confidence: 70% confidence
Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
Content: No source excerpt is available for this finding.

Skill Enumeration

Medium

Category: Agent Snooping
Confidence: 80% confidence
Finding: Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
Content: Scanner excerpt · references/setup.md (reported line 69)May include surrounding context.
Use podcast-helper for podcast transcription:

npx podcast-helper transcribe <input> --output-dir <dir> --json

ask before cleanup

see skills/transcribe/SKILL.md for workflow details

text

Rp1

Medium

Category: MCP Rug Pull
Confidence: 94% confidence
Finding: The verification instructions invoke npx podcast-helper without pinning an exact package version, which can cause the latest published package to be fetched and executed at runtime. If the package is compromised, typo-squatted, or a malicious update is published, anyone following the verification steps could execute attacker-controlled code on their machine or CI runner.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.