Security audit
Security checks for vulnerabilities and agentic risk
This is a straightforward Coze transcription helper that uploads a user-chosen audio file to Coze for ASR, with privacy considerations but no hidden or destructive behavior found.
Install only if you are comfortable sending selected audio files to Coze's API using your COZE_API_KEY. Do not use it for confidential, regulated, or third-party recordings unless you have the required consent and have checked Coze's data handling terms.
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
# Configuration
API_ENDPOINT="https://api.coze.cn/v1/audio/transcriptions"
# Get API key from environment
if [ -z "$COZE_API_KEY" ]; then
echo "Error: COZE_API_KEY environment variable is not set" >&2
echo "" >&2
The skill documents execution of a shell script but does not declare any tool scope such as allowed shell usage or permissions. This weakens review and containment by making execution capability implicit, which can lead users or platforms to run code without clear authorization boundaries.
The documentation instructs users to transcribe local audio through Coze's API but does not clearly warn that audio content is transmitted to an external third party. This creates a privacy and data handling risk, especially if users submit sensitive recordings without informed consent or awareness of external processing.
This skill transmits user-supplied audio to an external third-party endpoint for transcription, which creates a real data exfiltration/privacy boundary. In the context of an ASR skill this behavior is expected, but it is still security-relevant because audio may contain sensitive personal, corporate, or regulated information and is sent off-host using an API key.
set -e
# Configuration
API_ENDPOINT="https://api.coze.cn/v1/audio/transcriptions"
# Get API key from environment
if [ -z "$COZE_API_KEY" ]; then
The script sets the default transcription language to zh when the user does not provide a language argument. This imposes a specific locale choice by default rather than offering neutral behavior or explicit user opt-in, which matches the language/locale policy concern.
The description emphasizes Chinese audio transcription and the parameters set the default language to zh, while parts of the documentation and examples are also Chinese. This can impose a language/locale default without clearly obtaining user opt-in or presenting a neutral language choice up front.
No suspicious patterns detected.