Parakeet Local Asr

• Outcome: Review
• Latest audit: Sep 10, 2026 · 9:19 PM UTC
• Version: 0.1.0

Overview

This skill is purpose-aligned for local speech transcription, but its installer runs mutable third-party code from GitHub without pinning or verification.

Review the upstream parakeet-asr repository and the exact setup.sh revision before running bootstrap.sh. Prefer pinning a known commit or release, avoid PARAKEET_REPO_URL overrides unless you trust the source, and only send smoke-test audio to a trusted local endpoint.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (1)

T03 · Remote Payload Retrieval and Execution

Error

• Location: scripts/bootstrap.sh:4

Finding

Unpinned Remote Repository Is Downloaded and Executed

Content

View full analysis

Vulnerability Details

File Location: scripts/bootstrap.sh, lines 4-16
Vulnerability Type: Mutable remote payload retrieval and execution
Risk Level: High

Vulnerable Code

bash

PARAKEET_DIR="${PARAKEET_DIR:-$HOME/parakeet-asr}"
REPO_URL="${PARAKEET_REPO_URL:-https://github.com/rundax/parakeet-asr.git}"

if [ -d "$PARAKEET_DIR/.git" ]; then
  echo "Updating existing repo at $PARAKEET_DIR"
  git -C "$PARAKEET_DIR" pull --ff-only
else
  echo "Cloning repo to $PARAKEET_DIR"
  git clone "$REPO_URL" "$PARAKEET_DIR"
fi

cd "$PARAKEET_DIR"
./setup.sh

Technical Analysis

The bootstrap script clones or updates a third-party Git repository and immediately executes its setup.sh file. The retrieved revision is not pinned to an audited commit, and the script does not verify a cryptographic checksum, commit signature, or signed release.

Although git pull --ff-only prevents a non-fast-forward merge, it does not establish trust in newly retrieved commits. The effective installation payload can therefore change after this Skill has been reviewed. In addition, the PARAKEET_REPO_URL environment variable permits the repository source to be replaced with another Git repository.

This is a supply-chain execution boundary: the audited local script delegates code execution to mutable content that is not included in the audited project.

Attack Path

1. An attacker compromises or maliciously modifies the upstream repository, its active branch, or a repository selected through PARAKEET_REPO_URL.
2. A user or agent follows the documented workflow and runs:

   bash

   bash scripts/bootstrap.sh
   

3. The script clones the attacker-controlled repository or pulls its latest commits.
4. No expected commit ID, signature, or checksum is validated.
5. The downloaded setup.sh executes with the permissions of the user running the bootstrap script.
6. The remote setup code can perform any operation available to that user and may request or invok ...[truncated 651 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin the upstream source to a specific, previously audited commit hash rather than pulling the current branch tip.
2. Verify that the checked-out HEAD exactly matches the expected commit before executing any file:

   bash

   EXPECTED_COMMIT="approved-full-commit-hash"
   git clone --no-checkout "$REPO_URL" "$PARAKEET_DIR"
   git -C "$PARAKEET_DIR" checkout --detach "$EXPECTED_COMMIT"
   test "$(git -C "$PARAKEET_DIR" rev-parse HEAD)" = "$EXPECTED_COMMIT"
   

3. Prefer a signed release artifact and validate its cryptographic signature and SHA-256 checksum against values stored in the reviewed Skill.
4. Do not run git pull followed by automatic execution. Updates should require explicit review and an intentional revision change.
5. Reject PARAKEET_REPO_URL overrides by default, or require explicit user confirmation while displaying the resolved source and revision.
6. Inspect and present the downloaded setup actions before execution, especially package-manager commands, privilege requests, service installation, and network listeners.
7. Execute installation with the least-privileged account possible and avoid granting elevated privileges to unverified remote code.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (3)

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 95% confidence

Finding

The skill instructs the agent to run multiple shell scripts (bootstrap.sh, start.sh, healthcheck.sh, smoke-test.sh) but does not declare any explicit tool scope such as permissions or allowed-tools. That creates an authorization gap: an agent or orchestrator may expose shell execution without a least-privilege contract, increasing the chance of unintended command execution or unsafe operator assumptions about what the skill can do.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The bootstrap script clones or updates a remote Git repository and then immediately executes that repository's ./setup.sh with the user's privileges, without pinning to a trusted commit, validating signatures/checksums, or requiring confirmation. If the repository, upstream account, network path, or configurable REPO_URL is compromised, this becomes a straightforward remote code execution path during installation.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The script posts the audio file to an endpoint that defaults to plain HTTP, which exposes speech content and any associated metadata to interception or modification if the service is not strictly bound to a trusted local interface. In this skill's context, users may handle private voice recordings, so using an insecure transport without an explicit warning or stronger localhost-only enforcement creates a real confidentiality risk.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.