transcription

• Outcome: Review
• Latest audit: Sep 11, 2026 · 11:30 PM UTC
• Version: 1.0.1

Overview

This transcription skill does what it claims, but it uploads potentially sensitive recordings to a hardcoded private-network HTTP service without encryption or clear consent controls.

Review before installing. Only use this skill if you trust the service at 192.168.0.11:8080 and the network path to it, and avoid sensitive recordings unless the endpoint, retention policy, and transport security are acceptable. Prefer a version that lets you configure an HTTPS or loopback endpoint, clearly warns before upload, and uses secure temporary files for video extraction.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/transcribe_audio.py:16

Finding

Audio and video recordings are transmitted over unencrypted HTTP

Content

View full analysis

Vulnerability Details

File Location: scripts/transcribe_audio.py:16, 47-51, 113-117; scripts/transcribe_simple.py:11, 20-24; scripts/transcribe.sh:19-21
Vulnerability Type: Cleartext transmission of potentially sensitive media
Risk Level: High

Vulnerable Code

scripts/transcribe_audio.py:16, 47-51, 113-117:

python

WHISPER_ENDPOINT = "http://192.168.0.11:8080/v1/audio"

python

response = requests.post(
    f"{WHISPER_ENDPOINT}/transcriptions",
    files=files,
    data=data
)

python

response = requests.post(
    f"{WHISPER_ENDPOINT}/transcriptions",
    files=files,
    data=data
)

scripts/transcribe_simple.py:11, 20-24:

python

WHISPER_ENDPOINT = "http://192.168.0.11:8080/v1"

python

response = requests.post(
    f"{WHISPER_ENDPOINT}/transcriptions",
    files=files,
    data=data
)

scripts/transcribe.sh:19-21:

bash

curl -s -X POST "http://192.168.0.11:8080/v1/audio/transcriptions" \
  -F "file=@$FILE" \
  -F "model=whisper-small"

Technical Analysis

All three transcription clients upload the complete user-selected recording to a fixed endpoint using plain HTTP. HTTP provides neither transport confidentiality nor authenticated message integrity.

An attacker positioned on the same network path, such as a compromised router, malicious wireless access point, hostile local-network host with suitable interception capabilities, or compromised intermediary, may observe the multipart upload. The attacker may consequently recover the complete recording. A suitably positioned active attacker may also alter the server response and cause the client to display a forged transcript.

The Python clients do not configure request timeouts either, but the principal confirmed security issue is the cleartext transport of potentially sensitive media and transcription results.

Attack Path

1. A user invokes ...[truncated 1033 chars]

Remediation

View remediation

Remediation Suggestions

1. Replace the HTTP endpoint with an HTTPS endpoint protected by a certificate issued by a trusted internal or public certificate authority.
2. Retain certificate verification in the Python requests clients and curl; do not use verify=False, -k, or --insecure.
3. For a private service, consider certificate or public-key pinning and mutual TLS where operationally appropriate.
4. Make the endpoint configurable through a validated configuration source rather than embedding a network address throughout the scripts.
5. Reject non-HTTPS endpoints unless the service is strictly bound to a trusted loopback or similarly protected local transport and the security consequences are documented.
6. Inform users that recordings are uploaded to a transcription service before transmission.
7. Add explicit connection and response timeouts, status validation with response.raise_for_status(), and controlled error handling.
8. Apply equivalent transport protections consistently to both Python clients and the shell client.

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/transcribe_audio.py:19

Finding

Predictable conversion path permits file overwrite and unsafe cleanup

Content

View full analysis

Vulnerability Details

File Location: scripts/transcribe_audio.py:19-30, 54-56, 76-78, 120-122
Vulnerability Type: Unsafe temporary-file handling
Risk Level: Medium

Vulnerable Code

scripts/transcribe_audio.py:19-30:

python

def extract_audio_from_video(video_file):
    """Extract audio from video file using ffmpeg."""
    audio_file = f"{video_file}.wav"
    
    cmd = [
        "ffmpeg", "-y", "-i", video_file,
        "-vn", "-acodec", "pcm_s16le", "-ar", "16000", "-ac", "1",
        audio_file
    ]
    
    subprocess.run(cmd, check=True, capture_output=True)
    return audio_file

Cleanup in transcribe_audio, transcribe_simple, and transcribe_with_timestamps uses the same predictable path:

python

if actual_file != file_path and os.path.exists(actual_file):
    os.remove(actual_file)

Technical Analysis

Video conversion always writes to <video_file>.wav. The path is predictable, is not created through a secure temporary-file API, and is passed to ffmpeg with -y, which authorizes replacement of an existing output.

If a regular file already exists at that path, transcription can overwrite it and the subsequent cleanup deletes it. In a shared writable directory, another local user or process that can create filesystem entries may pre-position the destination. Depending on platform behavior, filesystem permissions, and how ffmpeg opens the output, a symbolic link or similar filesystem redirection may also expose another writable target to replacement.

Cleanup is performed only after the request has completed and its JSON response has been parsed. If file opening, the network request, or response.json() raises an exception, the cleanup block is not reached. The extracted WAV can then remain on disk and retain a clear, uncompressed copy of the recording.

The use of an argument array for subprocess.run prevents shell-command injection; the vuln ...[truncated 1640 chars]

Remediation

View remediation

Remediation Suggestions

1. Create conversion output through tempfile.TemporaryDirectory or another secure randomized temporary-file mechanism.
2. Set restrictive permissions so only the current account can access extracted recordings.
3. Do not derive temporary output names directly from attacker-influenced input paths.
4. Place cleanup in a finally block so it runs after request, decoding, and other processing failures.
5. Avoid overwriting existing paths. Ensure temporary files are created exclusively and do not follow symbolic links.
6. Prefer a private temporary directory rather than writing the extracted recording beside the source video.
7. Validate that the selected input is a regular file where the deployment's trust model requires it.
8. Handle cleanup errors explicitly without exposing sensitive paths or silently retaining media.

A safer structure is:

python

import tempfile
from pathlib import Path

def extract_and_transcribe(video_file):
    with tempfile.TemporaryDirectory(prefix="transcription-") as temp_dir:
        audio_file = Path(temp_dir) / "audio.wav"
        subprocess.run(
            [
                "ffmpeg", "-nostdin", "-i", video_file,
                "-vn", "-acodec", "pcm_s16le",
                "-ar", "16000", "-ac", "1",
                str(audio_file)
            ],
            check=True,
            capture_output=True
        )
        return submit_audio(audio_file)

The temporary directory context ensures randomized placement and cleanup even when transcription raises an exception.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (12)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 94% confidence

Finding

The script’s core behavior is transcription: it opens a supplied file, sends it to a Whisper endpoint, and returns the text. That aligns partially with the declared purpose for audio transcription. However, the description specifically claims support for both audio and video files and says it automatically handles audio extraction from video files. In the provided code, there is no video processing, no ffmpeg/subprocess usage for extraction despite importing subprocess, and no logic distinguishing or converting media types. Therefore the description overstates the implemented capability, creating a material description-behavior mismatch.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 95% confidence

Finding

The skill advertises behavior that requires both network access and local command/script execution, but it declares no explicit tool scope or permissions. That increases the chance an agent invokes broader capabilities than users expect, reducing transparency and weakening least-privilege controls.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The skill invites users to upload audio or video for transcription without clearly warning that the media will be sent to an API endpoint. Because uploaded media may contain sensitive conversations, PII, or confidential business data, failing to disclose off-device transmission undermines informed consent and can cause privacy or compliance violations.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The guide explicitly says user audio/video is sent to a Whisper API endpoint at http://192.168.0.11:8080/v1, but it does not disclose the privacy and security implications of transmitting potentially sensitive media off-process and over the network. Using plain HTTP to a network host also increases interception and misrouting risk, especially if users assume transcription happens locally within the skill boundary.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The script uploads the user-supplied media file to a remote service over plain HTTP, which provides no transport encryption or server authentication. This exposes potentially sensitive audio/video content to interception or tampering by anyone on the network path, and the script gives no warning that local files will be transmitted off-host.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/transcribe_audio.py (reported line 28)May include surrounding context.

python

audio_file
    ]
    
    subprocess.run(cmd, check=True, capture_output=True)
    return audio_file

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The script sends the full audio or extracted video audio to a remote Whisper API endpoint on a private-network host without any user-facing disclosure, confirmation, or transport-security guarantees. In a transcription skill, users may reasonably provide sensitive recordings, so silent transmission can expose private content to another service and, because the endpoint uses plain HTTP, to interception or misuse within the network path.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The script contradicts the declared skill behavior by sending audio to a hardcoded internal endpoint over plain HTTP rather than an expected OpenAI Whisper API destination. This creates undisclosed data exfiltration risk, enables interception or tampering in transit, and makes the true processing location opaque to users and reviewers.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The code uploads the full audio file to a remote service without any user-facing warning, consent step, or privacy disclosure. Because transcription inputs often contain sensitive conversations or personal data, silent transmission to a remote host materially increases confidentiality and compliance risk, especially when combined with plain HTTP transport.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The skill states that video files are handled automatically but does not warn users that local processing and audio extraction will occur, likely via ffmpeg or similar tooling. While lower risk than external transmission, undisclosed local processing can still surprise users, trigger execution of multimedia tooling, and affect expectations around resource use and handling of sensitive files.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 80% confidence

Finding

When given a video file, the script writes a derived WAV file to disk and later removes it, which affects local user data and may leave sensitive media artifacts if execution fails before cleanup. The code comments describe the behavior for developers, but there is no user-facing warning in the CLI or output that a temporary file will be created.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 78% confidence

Finding

The script invokes an external ffmpeg subprocess to process user-provided media files. While this is part of the implementation, the CLI provides no notice that an external tool will be executed on the user's system.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.