Security audit
Security checks for vulnerabilities and agentic risk
This skill does what it claims, but it may automatically send voice or audio attachments to Groq's cloud API without clear user confirmation.
Install only if you are comfortable with audio files being uploaded to Groq for transcription. Prefer invoking it only after an explicit user request, and avoid sending sensitive recordings unless the user has approved that cloud processing.
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
#!/usr/bin/env bash
# Transcribe audio files using Groq Whisper API
# Usage: transcribe.sh <audio_file> [language]
# Requires: GROQ_API_KEY env var or ~/.config/groq/credentials.json
set -euo pipefail
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
#!/usr/bin/env bash
# Transcribe audio files using Groq Whisper API
# Usage: transcribe.sh <audio_file> [language]
# Requires: GROQ_API_KEY env var or ~/.config/groq/credentials.json
set -euo pipefail
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
#!/usr/bin/env bash
# Transcribe audio files using Groq Whisper API
# Usage: transcribe.sh <audio_file> [language]
# Requires: GROQ_API_KEY env var or ~/.config/groq/credentials.json
set -euo pipefail
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
#!/usr/bin/env bash
# Transcribe audio files using Groq Whisper API
# Usage: transcribe.sh <audio_file> [language]
# Requires: GROQ_API_KEY env var or ~/.config/groq/credentials.json
set -euo pipefail
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
#!/usr/bin/env bash
# Transcribe audio files using Groq Whisper API
# Usage: transcribe.sh <audio_file> [language]
# Requires: GROQ_API_KEY env var or ~/.config/groq/credentials.json
set -euo pipefail
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
#!/usr/bin/env bash
# Transcribe audio files using Groq Whisper API
# Usage: transcribe.sh <audio_file> [language]
# Requires: GROQ_API_KEY env var or ~/.config/groq/credentials.json
set -euo pipefail
The skill advertises shell-based usage but does not declare any explicit tool scope or allowed tools. In agent environments, this can cause the runtime or orchestrator to permit broader-than-intended shell execution, increasing the chance of unsafe command use when the skill is invoked.
The skill description emphasizes convenience and cloud transcription but does not clearly warn that audio files are sent off-device to a third-party provider. Users or higher-level agents may therefore route sensitive voice data externally without informed consent, creating privacy and compliance risk.
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
console.groq.commkdir -p ~/.config/groq
echo '{"api_key":"gsk_your_key_here"}' > ~/.config/groq/credentials.json
chmod 600 ~/.config/groq/credentials.json
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
mkdir -p ~/.config/groq
echo '{"api_key":"gsk_your_key_here"}' > ~/.config/groq/credentials.json
chmod 600 ~/.config/groq/credentials.json
Or set GROQ_API_KEY env var.
The invocation guidance says to call the script whenever an audio or voice attachment is received and to pass the file path directly, without requiring user confirmation or checking sensitivity. This can lead to over-triggering and unintended exfiltration of private audio to the external Groq service.
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
if [[ -z "$GROQ_API_KEY" ]]; then
echo "Error: No Groq API key found." >&2
echo "Set GROQ_API_KEY env var or create ~/.config/groq/credentials.json:" >&2
echo ' {"api_key":"gsk_your_key_here"}' >&2
exit 1
fi
The script uploads the provided audio file to Groq's external API for transcription, which is a real data egress behavior. In this skill's context that transmission is the core function, but it still creates confidentiality risk because potentially sensitive voice content is sent to a third-party cloud service and the user may not realize that local files are leaving the host.
exit 1
fi
result=$(curl -s -X POST "https://api.groq.com/openai/v1/audio/transcriptions" \
-H "Authorization: Bearer $GROQ_API_KEY" \
-F "file=@${AUDIO_FILE}" \
-F "model=whisper-large-v3" \
No suspicious patterns detected.