Security checks across malware telemetry and agentic risk
This speech-translation skill does what it claims, but its optional notification features can run unrestricted local shell commands and pass sensitive speech-derived text to external processes or services.
Install only if you are comfortable reviewing and controlling the command hooks yourself. Avoid --transcript-command, --translation-command, --audio-command, VOICE_TRANSLATE_TEXT_COMMAND_TEMPLATE, and VOICE_TRANSLATE_AUDIO_COMMAND_TEMPLATE unless the exact command is trusted. Prefer local/mock or agent-file translation for sensitive audio, and use service translation only with a trusted endpoint because transcript text is sent to that service.
print(command)
return
subprocess.run(command, shell=True, check=True)
if __name__ == "__main__":"No command template provided. Use --command-template or set VOICE_TRANSLATE_TEXT_COMMAND_TEMPLATE."
)
subprocess.run(args.command_template, input=message.encode("utf-8"), shell=True, check=True)
if __name__ == "__main__":def _run_text_command(self, command: str | None, text: str) -> None:
if not command:
return
subprocess.run(command, input=text.encode("utf-8"), shell=True, check=True)
def _run_audio_command(self, command: str | None, audio_file: Path) -> None:
if not command:resolved = command.format(audio_file=str(audio_file))
else:
resolved = f'{command} "{audio_file}"'
subprocess.run(resolved, shell=True, check=True)
def notify_transcript(self, text: str) -> None:
self._run_text_command(self.transcript_command, text)64/64 vendors flagged this skill as clean.