MLX STT

• Outcome: Review
• Latest audit: Sep 10, 2026 · 7:40 AM UTC
• Version: 1.0.7

Overview

This local transcription skill is mostly coherent, but its installer can force-install a mutable prerelease tool and its broad triggers raise review-worthy execution risk.

Review the installer before use. Prefer a pinned stable mlx-audio version, avoid forced replacement unless intentional, and be cautious using confidential audio because temporary converted audio or transcript files may remain if the run fails or is interrupted.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: install.sh:5

Finding

Unpinned Prerelease Dependency Creates a Supply-Chain Execution Risk

Content

View full analysis

Remediation

View remediation

' ``` 2. Remove `--prerelease=allow` unless a specific reviewed prerelease is strictly required. 3. Avoid `--force` by default. Require an explicit upgrade or reinstall action before replacing an existing trusted installation. 4. Use a lock file or equivalent mechanism to pin transitive dependencies. 5. Where supported, verify downloaded artifacts using trusted hashes or signatures. 6. Review version changes before updating the pinned dependency and document the approved version in `SKILL.md`. ]]>

T09 · Insecure Skill Coding Practices

Note

• Location: mlx-stt.sh:3

Finding

Sensitive Temporary Audio and Transcript Files Are Not Reliably Removed

Content

View full analysis

/dev/null 2>&1 find "${tmpdir}" -type f -name "*.txt" -exec cat {} \; rm -rf "${tmpdir}" ``` ### Technical Analysis The script creates a temporary directory containing a converted copy of the input audio and generated transcript artifacts. Cleanup is performed only by the final `rm -rf` command. Because `set -e` is enabled, a failure in `ffmpeg`, model retrieval, speech-to-text inference, or transcript processing causes the script to exit before reaching the cleanup command. Termination by a signal can produce the same result. The temporary audio and any generated transcript files may consequently remain on disk. `mktemp -d` normally creates a randomly named directory with restrictive permissions, which limits immediate cross-user exposure on correctly configured systems. However, residual sensitive data remains accessible to the same account, privileged local processes, backup or forensic tooling, and any process that later gains access to that account. Storage duration is left to external operating-system cleanup policy. ### Attack Path 1. A user invokes the skill with confidential audio. 2. The script converts the source into `${tmpdir}/audio.wav`, and processing may also create transcript files. 3. Processing fails or the process is interrupted before line 17. A malformed input, unavailable model, insufficient disk space, or explicit process termination could trigger this condition. 4. The shell exits under `set - ...[truncated 686 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (3)

Chaining Abuse

High

• Category: Tool Misuse
• Confidence: 75% confidence

Finding

Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.

Content

Scanner excerpt · mlx-stt.sh (reported line 17)May include surrounding context.

sh

--audio "${audio_wav}" \
  --output-path "${tmpdir}/out" > /dev/null 2>&1

find "${tmpdir}" -type f -name "*.txt" -exec cat {} \;
rm -rf "${tmpdir}"

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The trigger phrases are very broad and include common natural-language requests like 'STT ...', 'ASR ...', 'Transcribe ...', and 'Convert audio to text ...'. This increases the chance the skill is invoked unintentionally, causing automatic execution of local scripts and dependency installation paths in contexts where the user may not have intended to run this specific skill.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The script recursively deletes the temporary directory with rm -rf after processing, but there is no prompt, log message, or comment disclosing this cleanup behavior to the user. Although the deletion is limited to a temp directory created by the script, it is still a destructive operation and the file provides no explicit warning.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.