ClawHub
Back to skill

Security audit

Faster Whisper Gpu

Security checks for vulnerabilities and agentic risk

Overview

This is a coherent local audio transcription skill with expected file output and model/dependency installation risks, but no evidence of hidden collection, persistence, destructive behavior, or deception.

Install in an isolated virtual environment, avoid running pip as root, and consider pinning or reviewing dependency versions before use. Expect first-run model downloads into the Hugging Face cache, and keep transcript output files private because they may contain sensitive spoken content.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
requirements.txt:1
Finding

Unpinned and Unverified Third-Party Dependencies

Content
View full analysis

Vulnerability Details

File Location: requirements.txt:1-3; related installation declarations in SKILL.md:21-30, SKILL.md:62-67, and README.md:19-28
Vulnerability Type: Supply-chain risk caused by mutable dependency resolution
Risk Level: Medium

Vulnerable Code

requirements.txt:1-3:

text
faster-whisper>=0.10.0
torch>=2.0.0
numpy>=1.24.0

SKILL.md:21-30:

yaml
    python_packages:
      - faster-whisper
      - torch
    install:
      - id: pip
        kind: pip
        packages:
          - faster-whisper
          - torch
        label: Install faster-whisper and PyTorch

SKILL.md:62-67:

bash
# Install dependencies
pip install faster-whisper torch

# Verify GPU is available
python -c "import torch; print(f'CUDA available: {torch.cuda.is_available()}')"

README.md:19-28:

bash
pip install faster-whisper torch
bash
python -c "import torch; print(f'CUDA available: {torch.cuda.is_available()}')"

Technical Analysis

The project installs third-party packages without exact version pins, artifact hashes, or a reviewed lockfile. The >= constraints allow any future version satisfying the lower bound, while the documented and skill-managed pip install commands impose no version constraints at all.

Pip may execute package build backends or installation hooks and subsequently loads package code when transcribe.py imports faster_whisper and torch. Therefore, the effective code executed by the skill can change over time without any modification to this repository. A compromised upstream release, package-index account, configured mirror, or transitive dependency could introduce attacker-controlled code.

This finding does not establish that the currently named packages are malicious. It identifies an unsafe and non-reproducible dependency installation process that creates a viable supply-chain exploitation ...[truncated 1512 chars]

Remediation
View remediation

Remediation Suggestions

  1. Replace lower-bound and unconstrained dependencies with exact versions reviewed and tested by the maintainers.
  2. Generate and commit a reproducible lockfile that includes all transitive dependencies for each supported Python and platform configuration.
  3. Record cryptographic hashes for accepted distributions and install with pip's --require-hashes option.
  4. Update the installation declarations in SKILL.md and the commands in README.md so they use the reviewed lockfile rather than installing mutable package names directly.
  5. Prefer binary wheels from an explicitly configured trusted index where practical, and prevent unexpected fallback to untrusted extra indexes or mirrors.
  6. Install dependencies in an isolated virtual environment under a non-privileged account. Do not run pip as root or from an account holding unnecessary secrets.
  7. Add automated dependency vulnerability and provenance checks to CI, including review of lockfile changes and transitive dependency updates.
  8. Establish a controlled update process that tests and approves new dependency versions before updating pins and hashes.
  9. Where supported, verify package signatures or provenance attestations and retain a software bill of materials for released skill versions.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (14)

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
70% confidence
Finding

Without declared permissions the skill's intent is opaque and cannot be validated.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The skill markets itself as '100% Local' and 'No data leaves your machine,' but it also states models are automatically downloaded from Hugging Face on first use. That means first-run behavior requires network access and may contact an external service, which can mislead privacy-sensitive users and violate assumptions in restricted or air-gapped environments.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The manifest describes the skill as local speech-to-text transcription, which implies converting speech to text in the same language. However, the code supports a separate 'translate' task and advertises it in the CLI, allowing users to translate audio content to English rather than just transcribe it.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The example usage explicitly shows '--task translate --format json', which goes beyond the manifest's stated purpose of speech-to-text transcription. This is a semantic scope expansion, not just an implementation detail, because translation is a distinct user-facing capability.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The help text states that the 'translate' task will translate audio 'to English', which hard-codes a specific language target rather than offering a user choice. This is a natural-language locale policy concern because the skill presents a forced language behavior with no opt-in or configurable alternative.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
86% confidence
Finding

This markdown file includes commands that save transcriptions to files, which can affect user data and may store sensitive spoken content. The examples show output generation but do not warn users about possible overwrites or that transcripts may contain private information.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
90% confidence
Finding

The Python API example writes .txt files alongside each input audio file, which could create many persisted transcripts from private recordings. Although the code prints what it wrote, the markdown does not warn users that this workflow stores potentially sensitive data to disk at scale.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
83% confidence
Finding

This markdown file shows commands that generate output files, including an explicit --output podcast.srt example and subtitle/text export formats, but it does not warn users that transcripts or translations may be saved locally and could contain sensitive spoken content. For a speech-to-text skill handling potentially private audio, a brief disclosure about local file creation and sensitive transcript data would improve user awareness.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
88% confidence
Finding

The troubleshooting section mentions the Hugging Face cache location, but the skill does not clearly warn up front that using the tool may trigger automatic model downloads. This omission can surprise users in privacy-sensitive, metered, or network-restricted contexts and weakens informed consent about external connectivity.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low
Category
Supply Chain
Confidence
97% confidence
Finding

The dependency specification for faster-whisper is only lower-bounded, which makes builds non-reproducible and allows future installs to pull in different versions with different security properties. While this file alone does not prove exploitation, unpinned packages increase supply-chain risk and make it harder to verify whether deployed versions are vulnerable.

Content

Scanner excerpt · requirements.txt (reported line 1)May include surrounding context.

text
faster-whisper>=0.10.0
torch>=2.0.0
numpy>=1.24.0

Unpinned Dependencies

Low
Category
Supply Chain
Confidence
99% confidence
Finding

torch is specified with only a minimum version, so installations may resolve to different releases over time, including releases affected by known vulnerabilities. Because PyTorch has a history of high-impact issues including code execution and denial of service in some usage patterns, leaving it unpinned materially increases supply-chain and exposure risk.

Content

Scanner excerpt · requirements.txt (reported line 2)May include surrounding context.

text
faster-whisper>=0.10.0
torch>=2.0.0
numpy>=1.24.0

Unverifiable Dependency: torch has 16 known advisory(ies) (CVE-2025-2953 (PyTorch susceptible to local Denial of Service); CVE-2022-45907 (PyTorch vulnerable to arbitrary code execution); CVE-2025-32434 (PyTorch: `torch.load` with `weights_only=True` leads to remote code execution) +13 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low
Category
Supply Chain
Confidence
93% confidence
Finding

The manifest does not pin torch, and torch has multiple published advisories, so the actual installed version cannot be assessed for safety from this file. In a local speech-to-text skill this is somewhat contextualized by expected offline processing, but the package is still powerful native code and ML infrastructure, so unresolved version ambiguity creates real risk if an affected release is installed.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low
Category
Supply Chain
Confidence
96% confidence
Finding

numpy is not pinned to a specific version, so dependency resolution may produce different artifacts across environments and over time. This weakens reproducibility and can unintentionally introduce vulnerable or incompatible releases into the skill.

Content

Scanner excerpt · requirements.txt (reported line 3)May include surrounding context.

text
faster-whisper>=0.10.0
torch>=2.0.0
numpy>=1.24.0

Unverifiable Dependency: numpy has 16 known advisory(ies) (CVE-2014-1859 (Numpy arbitrary file write via symlink attack); CVE-2021-41495 (NumPy NULL Pointer Dereference); CVE-2021-33430 (NumPy Buffer Overflow (Disputed)) +13 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low
Category
Supply Chain
Confidence
88% confidence
Finding

The manifest leaves numpy unpinned despite known advisories affecting some releases, making it impossible to determine whether deployments are exposed. The skill context does not suggest deliberate abuse, but unverified scientific-computing dependencies still expand the attack surface and can introduce memory-safety or file-handling issues through transitive use.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.