Transcribee 🐝

• Outcome: Review
• Latest audit: Sep 10, 2026 · 6:56 AM UTC
• Version: 1.2.1

Overview

This appears to be a genuine transcription tool, but it should be reviewed because it sends media and transcripts to external AI services and uses an unsafe model-chosen output path.

Review this before installing if you may transcribe private, regulated, copyrighted, or sensitive media. The tool uses your API keys, uploads audio to ElevenLabs, sends transcript-derived content to Anthropic, stores transcripts persistently in Documents, and should be fixed to validate category paths and restrict supported URLs before routine use.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Error

• Location: index.ts:321

Finding

Directory Traversal Through Unvalidated LLM-Generated Category Path

Content

View full analysis

0; const prompt = hasExistingTranscripts ? `You are maintaining a knowledge library of audio/video transcripts. SOURCE INFORMATION: URL: ${videoUrl} Title: ${videoTitle} CURRENT LIBRARY STRUCTURE: ${folderTreeString || '(Empty - this will be the first transcript)'} NEW TRANSCRIPT TO ORGANIZE: ${processedTranscript} YOUR TASK: 1. Analyze the new transcript's content and main themes 2. Review the existing library structure 3. Decide the optimal SINGLE-LEVEL category folder for this transcript DECISION CRITERIA: - Use existing folders when semantically appropriate (similar content/theme) - Create new categories when the content doesn't fit existing ones - Use kebab-case for folder names - Keep categories broad enough to group related content but specific enough to be meaningful - IMPORTANT: Use only ONE level of categorization (e.g., "ai-podcasts" not "technology/ai/podcasts") Respond with a JSON object (no markdown code blocks): { "newTranscriptPath": "category-name", "reasoning": "Explain why this category fits the content", "confidence": "high/medium/low" }` : `You are creating a knowledge library of audio/video transcripts. SOURCE INFORMATION: URL: ${videoUrl} Title: ${videoTitle} TRANSCRIPT: ${processedTranscript} This is the FIRST transcript in the library. Create an initial folder structure that: - Uses a SINGLE level of categorization - Is specific enough to be useful but n ...[truncated 4334 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (34)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · CLAUDE.md (reported line 16)May include surrounding context.

md

pnpm install

# Setup environment variables
cp .env.example .env
# Edit .env and add your API keys:
# - ELEVEN_LABS_API_KEY (for speech-to-text)
# - ANTHROPIC_API_KEY (for intelligent organization)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · README.md (reported line 70)May include surrounding context.

md

pnpm install

# Setup environment variables
cp .env.example .env
# Edit .env and add your API keys:
# - ELEVEN_LABS_API_KEY (for speech-to-text)
# - ANTHROPIC_API_KEY (for intelligent organization)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · CLAUDE.md (reported line 17)May include surrounding context.

md

# Setup environment variables
cp .env.example .env
# Edit .env and add your API keys:
# - ELEVEN_LABS_API_KEY (for speech-to-text)
# - ANTHROPIC_API_KEY (for intelligent organization)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · README.md (reported line 71)May include surrounding context.

md

# Setup environment variables
cp .env.example .env
# Edit .env and add your API keys:
# - ELEVEN_LABS_API_KEY (for speech-to-text)
# - ANTHROPIC_API_KEY (for intelligent organization)

Anti-Refusal Statement

High

• Category: Anti-Refusal
• Confidence: 96% confidence

Finding

The phrase 'use Android/web player clients to bypass restrictions' indicates deliberate circumvention of platform access controls or content restrictions. In this skill context, that broadens legal, policy, and abuse risk because the tool is specifically designed to fetch media from remote platforms and may access content in ways normal clients are not intended to.

Content

Scanner excerpt · CLAUDE.md (reported line 42)May include surrounding context.

md

The main script follows this pipeline:

1. **Video Metadata Extraction** (`getVideoTitle`): Uses yt-dlp to extract and sanitize the video title
2. **Audio Download** (`downloadAudio`): Downloads best quality audio as m4a using yt-dlp with Android/web player clients to bypass restrictions
3. **Transcription** (`transcribeAudio`): Sends audio to ElevenLabs `scribe_v1_experimental` model with diarization (speaker identification) enabled
4. **Library Structure Analysis** (`readLibraryStructure`): Reads existing transcript library from `~/Documents/transcripts/` as a flat folder structure
5. **Category Classification** (`classifyAndOrganize`): Uses Claude Sonnet 4 to analyze the transcript and decide which single-level category folder to place it in

Instruction Override

High

• Category: Prompt Injection
• Confidence: 95% confidence

Finding

The same 'bypass restrictions' language also functions as an instruction to evade normal safeguards or access constraints, which is unsafe in an agent skill because it can normalize or encourage circumvention behavior. In a media-ingestion skill, this makes the capability more dangerous by directly tying the override concept to content acquisition from third-party platforms.

Content

Scanner excerpt · CLAUDE.md (reported line 42)May include surrounding context.

md

The main script follows this pipeline:

1. **Video Metadata Extraction** (`getVideoTitle`): Uses yt-dlp to extract and sanitize the video title
2. **Audio Download** (`downloadAudio`): Downloads best quality audio as m4a using yt-dlp with Android/web player clients to bypass restrictions
3. **Transcription** (`transcribeAudio`): Sends audio to ElevenLabs `scribe_v1_experimental` model with diarization (speaker identification) enabled
4. **Library Structure Analysis** (`readLibraryStructure`): Reads existing transcript library from `~/Documents/transcripts/` as a flat folder structure
5. **Category Classification** (`classifyAndOrganize`): Uses Claude Sonnet 4 to analyze the transcript and decide which single-level category folder to place it in

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

A description-behavior mismatch is security-relevant here because the skill appears to do more than users are led to expect, including organizing local files, collecting richer metadata, and potentially handling additional URL types. When a skill understates its capabilities, users may provide sensitive inputs without understanding what will be stored, inspected, or transmitted, which undermines informed consent and safe deployment.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 91% confidence

Finding

A description-behavior mismatch is security-relevant here because the skill appears to do more than users are led to expect, including organizing local files, collecting richer metadata, and potentially handling additional URL types. When a skill understates its capabilities, users may provide sensitive inputs without understanding what will be stored, inspected, or transmitted, which undermines informed consent and safe deployment.

Content

No source excerpt is available for this finding.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · index.ts (reported line 14)May include surrounding context.

ts

const execFileAsync = promisify(execFile);

dotenv.config({ path: path.resolve(__dirname, '.env') });

// ---------- config -----------------------------------------------------------

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · index.ts (reported line 32)May include surrounding context.

ts

const execFileAsync = promisify(execFile);

dotenv.config({ path: path.resolve(__dirname, '.env') });

// ---------- config -----------------------------------------------------------

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · index.ts (reported line 40)May include surrounding context.

ts

const execFileAsync = promisify(execFile);

dotenv.config({ path: path.resolve(__dirname, '.env') });

// ---------- config -----------------------------------------------------------

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The documentation describes behavior beyond the stated transcription-only skill scope, including ingestion from multiple platforms and AI-driven categorization into a persistent knowledge library. This scope expansion matters because it changes the data handling and external-sharing surface presented to users and may cause the agent to perform actions the user did not reasonably expect.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The skill sends audio-derived and transcript content to external providers (ElevenLabs and Claude) but the documentation provides no privacy notice, consent flow, or warning about third-party data sharing. Users may unknowingly submit sensitive conversations, copyrighted media, or personal information to external services, creating confidentiality, compliance, and retention risks.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The README states that media is transcribed by ElevenLabs and analyzed by Claude, meaning user-provided audio/video content and derived transcript data are sent to third-party services. Without an explicit privacy warning, users may unknowingly submit sensitive recordings, private meetings, or copyrighted material to external APIs, creating confidentiality and compliance risk.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 83% confidence

Finding

The skill advertises operational behavior that depends on environment-based secrets or configuration (for example, an ElevenLabs API key via a .env file), but it does not declare any explicit tool scope or permissions boundaries. This weakens transparency and reviewability because users are not clearly told that the skill relies on environment access, which can hide secret-dependent behavior and increase the chance of unintended data access or exfiltration in broader implementations.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The skill states that transcription is performed via ElevenLabs but does not warn users that their media content will be transmitted to a third-party service. This is a real privacy and compliance concern because audio/video may contain sensitive personal, confidential, or regulated information, and users need clear notice before external processing occurs.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The skill persistently reads from and writes to ~/Documents/transcripts, which is broader access than a user would expect from a simple transcription tool. Because this behavior is not stated in the manifest, users may unknowingly expose prior transcripts and local metadata to later processing steps.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The code explicitly supports Instagram and other remote sources through yt-dlp, despite the stated scope being YouTube URLs and local files. This scope expansion increases the chance of processing unintended remote content and broadens the external attack surface beyond what users were told to expect.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The skill goes beyond the declared transcription function by classifying content and deciding where it belongs in a persistent library. This expands the data-processing scope and can surprise users, especially because full transcript content is sent to Anthropic for organization decisions rather than limiting processing to transcription output.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The classification prompt includes the new transcript plus summaries of the existing transcript library, meaning local user content and prior stored data are forwarded to an external model in plain language. This creates cross-document privacy leakage and unnecessarily broadens third-party exposure beyond the single file being transcribed.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The skill uploads audio to ElevenLabs for transcription and sends transcript content to Anthropic for classification without any user-facing notice or consent checkpoint. For local files or sensitive recordings, this creates a meaningful privacy risk because raw user content is transmitted to third-party services.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The manifest says the skill transcribes both YouTube videos and local audio/video files, but this wrapper script only presents usage for a YouTube URL and forwards just the first argument as a URL-like input. That creates a developer-intent mismatch because the exposed behavior in this file is limited to YouTube-style invocation rather than the broader file-transcription scope claimed by the skill description.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Low

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The manifest description says the skill transcribes YouTube videos and local audio/video files, but the README explicitly states support for Instagram Reels and TikTok URLs as well. This is a semantic mismatch in stated scope, even though the additional behavior is closely related to transcription.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Low

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The manifest describes producing speaker-labeled transcripts for LLM analysis, but the README says the skill also auto-categorizes transcripts using Claude and builds a self-organizing knowledge library. Those are materially broader behaviors than straightforward transcription output.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The skill writes transcripts and metadata into the user's Documents folder, but the description does not frame this as a storage/privacy implication. Even if the write location is stated, the lack of an explicit warning can lead users to unknowingly persist sensitive transcription content in a broadly accessible location, increasing the risk of local disclosure or accidental backup/sync exposure.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.