Security audit

Whisper Local Api

Security checks for vulnerabilities and agentic risk

Overview

This skill has a coherent local transcription purpose, but its install and runtime instructions understate important risks from mutable remote code, dependency execution, and network exposure.

Review this before installing. Use it only if you trust the upstream GitHub repository and its Python dependencies, pin or vendor the backend where possible, bind the service to 127.0.0.1 by default, avoid exposing port 9000 without authentication and TLS, and do not run smoke tests with sensitive audio unless the endpoint is confirmed loopback/local.

A.I.G

Vulnerability Patterns

Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (3)

T03 · Remote Payload Retrieval and Execution

Error

Location: scripts/bootstrap.sh:4
Finding: Mutable Third-Party Repository Is Downloaded, Installed, and Executed Without Integrity Verification
Content: View full analysis
/dev/null 2>&1; then echo "Warning: Port 9000 is already in use (possibly another Whisper instance running). Proceeding..." fi echo "Starting local, offline Whisper ASR safely..." bash run_server.sh & ``` ### Technical Analysis The bootstrap process clones or updates a mutable external Git repository without pinning an immutable commit or tag and without verifying a cryptographic checksum or signature. The `WHISPER_REPO_URL` environment variable also allows the source repository to be replaced. After retrieval, `pip install -r requirements.txt` installs dependencies controlled by the downloaded repository. Python package installation may execute package build hooks or other installation logic. The separa ...[truncated 1594 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/smoke-test.sh:10
Finding: Configurable Transcription Endpoint Can Exfiltrate Local Audio Files
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: SKILL.md:45
Finding: Documentation Directs Deployment of an Unauthenticated Service on All Network Interfaces
Content: View full analysis
`int8`) to prevent CPU crashes. ``` ### Technical Analysis Binding a server to `0.0.0.0` does not restrict it to the local machine. It instructs the server to listen on all available IPv4 interfaces. Whether the service is reachable externally then depends on host firewall rules, network routing, container port publication, and cloud security-group configuration. The documentation simultaneously describes the endpoint as local and secure, states that no authentication token is used, and characterizes `0.0.0.0` as a local bind. This can lead users to expose an unauthenticated plaintext HTTP service unintentionally. The server implementation and its binding configuration reside in the externally downloaded repository and were not present in the audited package. Therefore, its exact runtime behavior cannot be independently verified from these files. The confirmed issue in this package is the unsafe deployment instruction and security claim. ### Attack Path 1. A user follows the Skill documentation and starts the downloaded server. 2. The server binds to `0.0.0.0:9000` as described. 3. The host firewall, container configuration, local network, or cloud security group permits access to port 9000. 4. A remote client connects directly to the unauthentic ...[truncated 746 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (7)

Intent-Code Divergence

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: Claiming that binding to 0.0.0.0 is 'securely' local is incorrect: 0.0.0.0 listens on all interfaces, which can expose the transcription service to the LAN or internet depending on host firewalling and port forwarding. An unauthenticated audio transcription endpoint may allow unauthorized use, data exposure, service abuse, or pivoting through a falsely trusted local component.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The bootstrap script clones or pulls mutable code from a remote GitHub repository at install time, which breaks the claimed 'offline/local/secure' trust model and creates a supply-chain risk. If the repository is compromised, renamed, force-pushed, or the URL is overridden via environment variable, a user may fetch attacker-controlled code that is later executed during setup or runtime.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The script not only acquires remote code but also prepares it for execution by creating a virtual environment and installing Python dependencies from that fetched repository without pinning or integrity verification. This creates an end-to-end remote code execution supply-chain path through both the Git repo contents and Python package installation steps, exceeding what users would expect from a supposedly local/offline ASR skill.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 75% confidence
Finding: The skill instructs the user to run multiple shell scripts, but the manifest declares no explicit tool scope or permissions boundary. In an agent ecosystem, this can cause implicit shell-capable behavior without clear review expectations, increasing the chance that a consumer or orchestrator executes privileged local actions unknowingly.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 86% confidence
Finding: The documentation markets the service as '100% Offline & Private' and having 'Zero cloud dependencies' while also describing a network-accessible HTTP API. Even if no cloud provider is used, exposing an HTTP service creates local-network attack surface and can mislead operators into underestimating exposure, leading to unsafe deployment decisions.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The script labels the dependency installation as 'secure' and the result as 'Safe to run' even though it has just downloaded mutable remote source and packages. These assurances can mislead operators into granting trust they have not actually established, increasing the likelihood that a supply-chain compromise or unsafe update is accepted without scrutiny.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The script prints a strong privacy assurance that 'no data [is] sent to cloud' while allowing the destination endpoint to be overridden via WHISPER_API_URL. If that variable points to a remote server, the provided audio file will be uploaded off-host, creating a mismatch between the security claim and the actual behavior that can mislead users into exposing sensitive audio.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.