Local Whisper

• Outcome: Review
• Latest audit: Sep 10, 2026 · 7:33 AM UTC
• Version: 1.5.0

Overview

The skill claims private local transcription, but its packaged code can automatically send audio to OpenAI or Groq and exposes an unauthenticated local daemon.

Review carefully before installing. Do not rely on the current package as local-only unless cloud dependencies and auto cloud fallback are removed or disabled. Avoid loading the LaunchAgent plist unless you have audited the exact plist and know how to unload it. Run the daemon only in a trusted local environment, and prefer an authenticated or upload-only design that does not accept arbitrary filesystem paths.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• System Persistence: Installs backdoors, hooks, services, or scheduled tasks that survive the run
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads

Findings (6)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/transcribe_large.sh:42

Finding

Python Code Injection Through an Unsafely Interpolated Audio Path

Content

View full analysis

Remediation

View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: scripts/daemon.py:120

Finding

Unauthenticated Daemon Accepts Arbitrary Local Filesystem Paths

Content

View full analysis

Remediation

View remediation

T06 · System Persistence

Warning

• Location: README.md:35

Finding

Optional Login Persistence Uses an Unavailable and Unaudited LaunchAgent Definition

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/daemon.py:104

Finding

Unbounded HTTP Request Body Can Exhaust Memory, Disk, and Processing Resources

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/transcriber.py:112

Finding

Automatic Backend Selection Can Upload Audio Despite Local-Only Privacy Claims

Content

View full analysis

Remediation

View remediation

T08 · Insecure Dependencies

Warning

• Location: requirements.txt:4

Finding

Unpinned Dependencies and Unnecessary Cloud SDKs Increase Supply-Chain Exposure

Content

View full analysis

=1.0.0 # OpenAI Whisper API openai>=1.12.0 # Groq API (optional - fast & cheap cloud) groq>=0.4.0 # Local faster-whisper (optional - CPU-based) faster-whisper>=1.0.0 # MLX Lightning Whisper (Apple Silicon - fastest local option) # Only works on macOS with M1/M2/M3/M4 lightning-whisper-mlx>=0.0.10; sys_platform == "darwin" and platform_machine == "arm64" ``` The installation instruction is: ```bash pip3 install -r requirements.txt ``` ### Technical Analysis Every dependency uses a lower-bound constraint without an upper bound, exact version, lockfile, or package hash. A future direct or transitive release can therefore be selected without review, causing different installations to execute materially different package code. The project is marketed as local transcription, yet the default dependency installation includes OpenAI and Groq SDKs. This unnecessarily enlarges the dependency graph and also enables the automatic cloud-backend behavior when credentials are present. The audited names correspond to known package names; the available evidence does not establish dependency confusion, typosquatting, or an intentionally malicious package. The finding concerns unsafe version policy and avoidable supply-chain exposure. ### Attack Path 1. The user runs the documented pip installation command. 2. Pip resolves the newest versions satisfying the lower bounds. 3. A compromised, malicious, or unexpectedly incompatible eligible direct or transitive release is selected. 4. Package build, installation, import, or runtime code executes in the user's Python environment. 5. The package receives the privileges and data available to the transcription process. ### Impact Assessment A compromised dependency could execute code with the installi ...[truncated 399 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (31)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 89% confidence

Finding

The claimed scope is a private local Apple-Silicon MLX Whisper skill, but the finding indicates backend and model selection beyond that scope, including non-local/cloud options. This broader-than-declared behavior is dangerous because users may deploy it under false assumptions about privacy boundaries, platform restrictions, and where their data is processed.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 88% confidence

Finding

The claimed scope is a private local Apple-Silicon MLX Whisper skill, but the finding indicates backend and model selection beyond that scope, including non-local/cloud options. This broader-than-declared behavior is dangerous because users may deploy it under false assumptions about privacy boundaries, platform restrictions, and where their data is processed.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

The claimed scope is a private local Apple-Silicon MLX Whisper skill, but the finding indicates backend and model selection beyond that scope, including non-local/cloud options. This broader-than-declared behavior is dangerous because users may deploy it under false assumptions about privacy boundaries, platform restrictions, and where their data is processed.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 94% confidence

Finding

The claimed scope is a private local Apple-Silicon MLX Whisper skill, but the finding indicates backend and model selection beyond that scope, including non-local/cloud options. This broader-than-declared behavior is dangerous because users may deploy it under false assumptions about privacy boundaries, platform restrictions, and where their data is processed.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The file-level documentation explicitly advertises cloud backends (OpenAI and Groq) even though the skill metadata promises private local transcription with no API costs. This mismatch is dangerous because users may rely on the manifest’s privacy claims while audio can in fact be routed to third-party services, creating confidentiality and billing risk.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The automatic backend selection falls back to OpenAI or Groq whenever their packages and API keys are present, despite the skill being described as local and private. In environments where these credentials are set, users can unknowingly have audio sent off-device and incur charges, directly violating expected trust and privacy boundaries.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 75% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · README.md (reported line 38)May include surrounding context.

Auto-Start

bash

cp com.local-whisper.plist ~/Library/LaunchAgents/
launchctl load ~/Library/LaunchAgents/com.local-whisper.plist

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 75% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · README.md (reported line 39)May include surrounding context.

Auto-Start

bash

cp com.local-whisper.plist ~/Library/LaunchAgents/
launchctl load ~/Library/LaunchAgents/com.local-whisper.plist

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 75% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 105)May include surrounding context.

Auto-Start

bash

cp com.local-whisper.plist ~/Library/LaunchAgents/
launchctl load ~/Library/LaunchAgents/com.local-whisper.plist

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 75% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 106)May include surrounding context.

Auto-Start

bash

cp com.local-whisper.plist ~/Library/LaunchAgents/
launchctl load ~/Library/LaunchAgents/com.local-whisper.plist

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 75% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · README.md (reported line 39)May include surrounding context.

bash

cp com.local-whisper.plist ~/Library/LaunchAgents/
launchctl load ~/Library/LaunchAgents/com.local-whisper.plist

Requirements

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 75% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 106)May include surrounding context.

bash

cp com.local-whisper.plist ~/Library/LaunchAgents/
launchctl load ~/Library/LaunchAgents/com.local-whisper.plist

Requirements

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 93% confidence

Finding

The skill requests users to run shell commands, install Python packages, start a daemon, expose a localhost HTTP service, and configure a CLI command, but it declares no explicit tool scope or permissions. This is dangerous because reviewers and users cannot easily see that the skill needs shell, network, environment, and file-write capabilities, increasing the chance of over-trusting or deploying it in contexts where those capabilities are inappropriate.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The file comments market the package as a local Whisper/MLX solution while simultaneously including cloud API packages. That inconsistency is security-relevant because operators may deploy the skill under the assumption that sensitive voice data remains on-device, when the dependency set supports remote transmission and expands the attack surface.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The requirements declare cloud STT client libraries (OpenAI and Groq) even though the skill is described as private and local-only. This creates a real trust-boundary mismatch: downstream code can silently route audio or transcripts to third-party services, defeating users’ privacy expectations and increasing the chance of unintended data exfiltration.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The JSON mode allows a caller to supply an arbitrary local file path, and the daemon will verify existence, read its size, and pass it to the transcriber. Because the service listens on localhost without authentication, any local process able to connect can induce reads of arbitrary files and potentially exfiltrate sensitive content if the downstream transcription stack or error messages expose file-derived data.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The help text explicitly states that translation mode is 'to English', which imposes a specific output language. The file does not present this as a user choice at request time or document locale selection safeguards, so it can violate language/locale policy expectations.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The script claims private local transcription, but its default behavior is to contact a daemon over HTTP first and send metadata about the user-supplied audio file, including its absolute path. Even if the file contents are not uploaded by this script, transmitting local filesystem paths to a network service can leak sensitive host information and violates the stated privacy expectation, especially if the daemon is remote via environment configuration.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 86% confidence

Finding

This curl invocation performs external transmission to an endpoint controlled by an environment variable, so the destination may be non-local even though the default is localhost. In the context of a speech-to-text skill marketed as local and private, unguarded network transmission increases the risk of privacy leakage and surprising data flow beyond what users expect.

Content

Scanner excerpt · scripts/transcribe.sh (reported line 75)May include surrounding context.

sh

)
    
    local response
    response=$(curl -s -X POST "$DAEMON_URL/transcribe" \
        -H "Content-Type: application/json" \
        -d "$json_payload" \
        --connect-timeout 2 \

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The script sends the absolute audio file path to a daemon over plain HTTP without any explicit runtime warning or consent flow. This can expose usernames, directory names, project names, or other sensitive path elements to another process or host, and if CLAWD_WHISPER_URL is changed from localhost, the disclosure extends off-device contrary to the skill's privacy-focused description.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The script usage and argument parsing indicate support for both --translate and --language, suggesting those options affect the transcription request. In the embedded Python code, only translation_mode is used and the parsed LANGUAGE value is never passed to Transcriber.transcribe, so the documented language option does nothing.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The top-level docstring presents the module as a transcription component while enumerating OpenAI and Groq cloud backends. In the context of a manifest advertising private local Apple-Silicon transcription with no API costs, this documentation reflects an implementation intent that contradicts the claimed skill intent rather than merely omitting details.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The skill's stated purpose is local transcription with MLX Whisper on Apple Silicon, but the code checks for OPENAI_API_KEY and GROQ_API_KEY and later uses them to initialize remote clients. Credential handling for third-party cloud services is not justified by a manifest centered on private local processing.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The API transcription path opens the local audio file and submits it to external transcription services without any user-facing warning or consent mechanism in this code. In the context of a skill advertised as private/local for Telegram and WhatsApp audio, this creates meaningful privacy risk because potentially sensitive voice messages may be exfiltrated to third parties unexpectedly.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 78% confidence

Finding

Line L047 tells the user to replace their existing tools.media.audio config, and the later config block wires all supported voice-message transcription through this local script. While the file explains benefits and model download behavior, it does not explicitly warn that this modifies the user's global transcription pipeline and may affect existing behavior for incoming media.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.