meeting-to-text

• Outcome: Review
• Latest audit: May 29, 2026 · 9:25 PM UTC
• Version: 1.0.0

Overview

This skill mostly matches a local meeting-transcription purpose, but it may quietly download a speaker model despite claiming to be fully local.

Install only if you are comfortable running a local Python/FFmpeg transcription pipeline on files you choose and with the possibility that it may contact ModelScope to fetch a speaker model if not already cached. For private or offline meetings, preinstall and verify all models, block network access during runs, and review the chosen output path before execution.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (7)

Tainted flow: 'command' from os.getenv (line 133, credential/environment) → subprocess.run (code execution)

Medium

• Category: Data Flow

Content

"pcm_s16le",
        str(output_wav_path),
    ]
    completed = subprocess.run(command, capture_output=True, text=True, encoding="utf-8", errors="replace")
    if completed.returncode != 0 or not output_wav_path.exists():
        message = completed.stderr.strip() or completed.stdout.strip() or "ffmpeg failed to normalize media"
        raise MediaError(message)

• Confidence: 89% confidence
• Finding: completed = subprocess.run(command, capture_output=True, text=True, encoding="utf-8", errors="replace")

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 89% confidence
• Finding: The skill instructs the agent to read environment-specific runtime paths, invoke a local Python interpreter, and write transcript files, which are privileged capabilities, yet no permissions are explicitly declared. This creates a transparency and policy-enforcement gap: an orchestrator or reviewer may underestimate the skill's access to the filesystem, shell, and environment-derived paths, increasing the chance of unsafe execution in a broader agent system.

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: The skill claims to be fully local, but if the speaker model cache is missing it silently downloads a model from a remote hub. This breaks the advertised trust boundary and can leak metadata, create supply-chain exposure, and violate user expectations for offline/private transcription workflows.

Context-Inappropriate Capability

High

• Confidence: 95% confidence
• Finding: The code performs network-capable model retrieval during runtime for a task described as local transcription. That unnecessary remote dependency expands the attack surface through model supply-chain compromise and can unexpectedly transmit usage metadata in privacy-sensitive meeting-transcription contexts.

Natural-Language Policy Violations

Medium

• Confidence: 84% confidence
• Finding: The skill description mandates Chinese speaker labels like `说话人1`, `说话人2` regardless of user preference. This is not a code-execution issue, but it is a real safety/quality problem because it overrides user intent and can produce misleading or unusable output for non-Chinese workflows, especially in automated pipelines that expect locale-appropriate labels.

Natural-Language Policy Violations

Medium

• Confidence: 86% confidence
• Finding: The behavior guarantee hardcodes transcript output to use `说话人N` labels, removing flexibility at the implementation-contract level. In context, this makes the issue more persistent because downstream consumers may rely on the guaranteed format, causing localization mismatches, broken integrations, or user confusion when transcripts are generated in an unexpected language.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The code may download a model from the network without informing the user, which is a meaningful security/privacy issue in a tool marketed as local. Even if the download itself is not directly exploitable, the lack of disclosure hides network activity and undermines informed consent for sensitive audio processing.

VirusTotal

65/65 vendors flagged this skill as clean.

Static analysis

Detected: suspicious.dynamic_code_execution

Dynamic code execution detected.

Critical

• Code: suspicious.dynamic_code_execution
• Location: scripts/meeting_to_text.py:225