Security audit
Security checks for vulnerabilities and agentic risk
This skill coherently transcribes user-selected audio or video through EmpirioLabs, with expected API-key, network, upload, polling, and optional output-file behavior.
Install only if you are comfortable sending selected audio/video content, media URLs, and resulting transcript data to EmpirioLabs for processing. Do not use it for confidential or regulated recordings unless that provider and account are approved for that data.
The skill invokes a Python script that uses environment secrets, writes output files, and performs network access, but it does not declare an explicit tool scope such as permissions or allowed-tools. That mismatch weakens sandboxing and user/operator awareness, increasing the chance the skill is granted broader capabilities than intended or executed without proper review of sensitive actions.
The skill description explains functionality but does not prominently warn that both local files and supplied HTTPS URLs are sent to a third-party service for transcription. Users may provide sensitive recordings under the assumption processing is local, causing unintended disclosure of confidential audio, transcripts, metadata, or URL-accessible content to an external provider.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
__version__ = "1.0.0"
API_BASE = "https://api.empiriolabs.ai/v1"
KEY_ENV = "EMPIRIOLABS_API_KEY"
KEYS_URL = "https://platform.empiriolabs.ai/dashboard/api-keys"
BILLING_URL = "https://platform.empiriolabs.ai/dashboard/billing"
Tool defaults are unsafe or overly permissive (e.g. disabled TLS verification, no authentication, world-writable permissions). Unsafe defaults widen the attack surface.
def list_models(timeout=60.0):
"""The public model catalog. No API key is needed."""
payload = get_json("/models", auth=False, timeout=timeout)
models = payload.get("data") if isinstance(payload, dict) else payload
return models if isinstance(models, list) else []
Tool defaults are unsafe or overly permissive (e.g. disabled TLS verification, no authentication, world-writable permissions). Unsafe defaults widen the attack surface.
def list_models(timeout=60.0):
"""The public model catalog. No API key is needed."""
payload = get_json("/models", auth=False, timeout=timeout)
models = payload.get("data") if isinstance(payload, dict) else payload
return models if isinstance(models, list) else []
Data from a source is assigned to a variable that is later passed to a sink, creating a variable-mediated taint flow.
os.makedirs(folder, exist_ok=True)
partial = path + ".part"
try:
with open(partial, "wb") as handle:
while True:
chunk = resp.read(1024 * 256)
if not chunk:
The script accepts either a local file path or a remote URL and sends the audio/video content to an external transcription API, but it does not present any explicit warning, consent check, or data-sharing notice at the point of use. Because transcription inputs commonly contain sensitive personal, business, or regulated information, users may inadvertently exfiltrate confidential content to a third party without realizing it.
No suspicious patterns detected.