WJS Transcribing Audio

• Outcome: Pass
• Latest audit: Jun 28, 2026 · 12:22 PM UTC
• Version: 8.0.0

Overview

This skill is a disclosed audio-to-subtitle workflow that uses external transcription services and local credentials as expected, with privacy and credential-handling cautions rather than evidence of malicious behavior.

Install only if you are comfortable sending audio to OpenAI or ByteDance/Volcano for transcription and exposing the needed API keys to the agent session. Prefer narrowly scoped environment variables over sourcing a broad ~/code/.env, and review the Chinese correction diff when transcript fidelity matters.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (9)

Tainted flow: 'FFMPEG' from os.environ.get (line 31, credential/environment) → subprocess.run (code execution)

Medium

• Category: Data Flow

Content

def to_pcm(path):
    if path.endswith(".pcm"):
        return open(path, "rb").read()
    out = subprocess.run([FFMPEG, "-v", "error", "-i", path, "-vn", "-ac", "1",
                          "-ar", "16000", "-f", "s16le", "-"], capture_output=True)
    return out.stdout

• Confidence: 87% confidence
• Finding: The executable path comes from the FFMPEG_BIN environment variable and is passed directly to subprocess.run. If an attacker can influence the environment in the agent runtime, they can replace ffmpeg with an arbitrary program and achieve code execution when transcription runs.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 95% confidence
• Finding: The skill clearly instructs use of shell commands, environment sourcing, and writing output files, yet declares no permissions. That mismatch can bypass user or platform expectations about what the skill is allowed to do, especially when it loads secrets from local files and writes artifacts in place.

Description-Behavior Mismatch

Medium

• Confidence: 87% confidence
• Finding: The skill expands beyond transcription into mandatory content rewriting of the generated SRT. Even though framed as typo correction, this changes user data after transcription and can alter meaning, proper nouns, or evidentiary fidelity without explicit opt-in.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The skill directs use of stored credentials and external ASR services but does not require an explicit user-facing warning that audio will leave the machine and be sent to third parties. For potentially sensitive recordings, silent transmission to OpenAI or Volcano creates confidentiality, compliance, and consent risks.

Missing User Warnings

Medium

• Confidence: 83% confidence
• Finding: This script streams user audio to a third-party ASR endpoint over WebSocket, but the transmission point provides no explicit user-facing disclosure or consent check. In a transcription skill, this is especially relevant because audio often contains sensitive personal, business, or regulated information.

Ssd 3

High

• Confidence: 98% confidence
• Finding: The documentation explicitly instructs sourcing secrets from local env files in plain language. That encourages broad secret exposure to the runtime and increases the chance of accidental disclosure, misuse by other commands, or exfiltration by any later-added step in the same execution context.

Ssd 3

High

• Confidence: 97% confidence
• Finding: The skill goes further than using stored secrets: it describes how to reuse and reconstruct equivalent credentials across services from user environment state. That unnecessarily expands credential propagation and normalizes cross-service secret reuse, increasing blast radius if one workflow or service is compromised.

External Transmission

Medium

• Category: Data Exfiltration

Content

"temperature": "0.2",                    # enable fallback chain (anti-loop)
}
with open("chunk.mp3", "rb") as f:
    r = httpx.post(
        "https://api.openai.com/v1/audio/transcriptions",
        headers={"Authorization": f"Bearer {os.environ['OPENAI_API_KEY']}"},
        data=data,

• Confidence: 94% confidence
• Finding: This code path sends user audio content to an external API endpoint. In a transcription skill that is expected behavior, but it is still a real data-transfer risk because audio may contain sensitive or regulated content and the transmission occurs under locally stored credentials.

Env Variable Harvesting

High

• Category: Data Exfiltration

Content

with open("chunk.mp3", "rb") as f:
    r = httpx.post(
        "https://api.openai.com/v1/audio/transcriptions",
        headers={"Authorization": f"Bearer {os.environ['OPENAI_API_KEY']}"},
        data=data,
        files={"file": ("chunk.mp3", f, "audio/mpeg")},
        timeout=600.0,

• Confidence: 95% confidence
• Finding: The skill accesses an API key from the environment at runtime while also encouraging sourcing a broad env file. In this context, environment harvesting is dangerous because it couples secret access with shell execution and network operations, creating a straightforward path for unauthorized secret use or accidental leakage.

Static analysis

No suspicious patterns detected.