Voice Transcription

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 7:27 AM UTC
• Version: 1.0.0

Overview

This is a straightforward transcription skill that sends selected audio to SiliconFlow, with privacy and credential-handling caveats but no hidden, destructive, or persistence behavior found.

Install only if you are comfortable sending audio files to SiliconFlow for transcription. Avoid using the documented --api-key command form for real credentials; use a protected environment variable or secret store instead, and do not process confidential recordings without confirming the provider's privacy and retention terms.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/transcribe.py:86
• Finding: API Key Exposure Through Command-Line Arguments## Vulnerability Details **File Location**: `scripts/transcribe.py:86-94`; documented usage at `SKILL.md:41-43` **Vulnerability Type**: Credential exposure through process arguments and shell history **Risk Level**: Medium ### Vulnerable Code `scripts/transcribe.py:86-94`: ```python parser.add_argument("--api-key", "-k", help="SiliconFlow API Key (也可设置环境变量 SILICONFLOW_API_KEY)") parser.add_argument("--output", "-o", help="输出文件路径 (默认输出到 stdout)") parser.add_argument("--json", action="store_true", help="以 JSON 格式输出") args = parser.parse_args() # 获取 API Key api_key = args.api_key or os.environ.get("SILICONFLOW_API_KEY", "") if not api_key: ``` `SKILL.md:41-43`: ```bash # 指定 API Key python3 scripts/transcribe.py audio.mp3 --api-key sk-xxx ``` ### Technical Analysis The script accepts a sensitive SiliconFlow API key as a command-line argument, and the documentation explicitly recommends this invocation method. Command-line arguments are not an appropriate secret transport mechanism because they may be: - Recorded in shell history. - Captured by command-execution telemetry or audit logs. - Visible to sufficiently privileged local users through process inspection facilities while the command is running. - Retained in terminal session logs or automation logs. The API key is not hardcoded or intentionally transmitted anywhere other than the declared SiliconFlow API endpoint. Nevertheless, accepting and documenting command-line secret input unnecessarily increases credential exposure. The already-supported `SILICONFLOW_API_KEY` environment variable is safer than the documented argument, although protected credential storage or an interactive secret prompt would be preferable. ### Attack Path 1. A user follows the documented example and invokes the script with `--api-key sk-xxx`. 2. The complete command is stored in shell history, execution telemetry, a process listing, or an automation log. 3. An ...[truncated 847 chars]
• Remediation: ## Remediation Suggestions 1. Remove or deprecate the `--api-key` command-line option. 2. Remove the command-line API-key example from `SKILL.md`. 3. Prefer a secret supplied through a protected credential manager or configuration file with restrictive permissions. 4. If an environment variable remains supported, document that it should be set without placing the key directly in reusable shell commands. 5. Optionally use `getpass.getpass()` to request the credential interactively when no protected configuration is available. 6. If backward compatibility requires retaining `--api-key`, emit a clear warning explaining that command-line secrets may be exposed through shell history, process inspection, and logs. 7. Rotate any key that has already been placed in shared shell history, CI logs, or execution telemetry.

T08 · Insecure Dependencies

Note

• Location: SKILL.md:9
• Finding: Unpinned Third-Party Dependency Installation## Vulnerability Details **File Location**: `SKILL.md:9-13` **Vulnerability Type**: Uncontrolled third-party dependency resolution **Risk Level**: Low ### Vulnerable Code ```yaml install: - id: requirements kind: pip packages: ["requests"] label: "Install Python requests library" ``` ### Technical Analysis The installation configuration requests `requests` without specifying a reviewed version or integrity hash. Consequently, the package version and its transitive dependencies are resolved at installation time rather than being reproducibly fixed. The dependency name is legitimate and there is no evidence that the project intentionally references a malicious, misspelled, or privately shadowed package. The risk arises from mutable dependency resolution: a compromised upstream release, compromised package index, or unexpectedly incompatible future release could alter installation or runtime behavior after the Skill has been reviewed. Because package installation and imported package initialization execute code in the installing user's context, a malicious dependency release could act with that user's permissions. ### Attack Path 1. An attacker compromises an upstream package release, dependency, maintainer account, or package-distribution channel. 2. A user installs the Skill after the compromised version becomes the version selected by pip. 3. The unpinned declaration resolves and downloads the affected package or transitive dependency. 4. Malicious code executes during installation or when `requests` is imported and used by `scripts/transcribe.py`. 5. The payload acts with the privileges of the user or service account installing or running the Skill. This path depends on an external supply-chain compromise; no malicious dependency is currently demonstrated by the audited files. ### Impact Assessment In the event of an upstream compromise, the dependency could access files, environment varia ...[truncated 422 chars]
• Remediation: ## Remediation Suggestions 1. Pin `requests` to a reviewed, compatible version rather than resolving an unrestricted latest version. 2. Lock all transitive dependencies to reviewed versions. 3. Use package hashes, such as pip hash-checking mode, to verify downloaded artifacts. 4. Maintain a lock file or reproducible requirements file and update it through a controlled dependency-review process. 5. Run dependency vulnerability scanning whenever the lock file is changed. 6. Where practical, consider using Python's standard HTTP libraries to eliminate the third-party runtime dependency. 7. Install dependencies in an isolated, least-privileged virtual environment rather than a privileged or system-wide Python environment.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (5)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 92% confidence
• Finding: The skill declares installation and execution requirements that imply environment access, network access, and likely file output, but it does not declare any explicit tool scope or permissions boundaries. This creates a least-privilege and transparency problem: the agent may invoke the skill without clear user/admin visibility into what resources it can access, increasing the chance of unintended data exposure or overly broad execution.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The skill documentation does not clearly warn users that uploaded audio will be sent to SiliconFlow, an external third-party API, for processing. This is dangerous because audio often contains sensitive personal, business, or regulated information, and users may reasonably assume local processing unless external transfer is disclosed.

Vague Triggers

Medium

• Confidence: 95% confidence
• Finding: The invocation guidance uses broad conversational triggers such as references to 'listen to this recording' or 'speech-to-text,' which can overlap with ordinary user dialogue. That raises the risk of accidental skill activation on sensitive audio, causing unintended transmission of files or content to the transcription backend without sufficiently explicit user intent.

Natural-Language Policy Violations

Medium

• Confidence: 95% confidence
• Finding: This code file contains user-facing natural-language strings exclusively in Chinese, starting with the module docstring and continuing through CLI descriptions and error messages. Under the stated policy, forcing a specific language without user opt-in is a natural-language policy violation because users are not offered any locale choice or documented justification.

External Transmission

Medium

• Category: Data Exfiltration

Content

print("错误: 需要 requests 库，请运行: pip3 install requests", file=sys.stderr)
    sys.exit(1)

API_URL = "https://api.siliconflow.cn/v1/audio/transcriptions"
AVAILABLE_MODELS = ["FunAudioLLM/SenseVoiceSmall", "TeleAI/TeleSpeechASR"]
MAX_FILE_SIZE = 50 * 1024 * 1024  # 50MB

• Confidence: 92% confidence
• Finding: This script uploads local audio files and an API credential to an external third-party service for transcription. In a skill context, that creates a real data-exfiltration boundary: sensitive audio content may leave the local environment, and users may not fully appreciate the privacy, compliance, or confidentiality implications.

Static analysis

No suspicious patterns detected.