Transcribe

• Outcome: Review
• Latest audit: Sep 10, 2026 · 6:44 AM UTC
• Version: 1.0.2

Overview

This transcription skill appears purpose-aligned, but its installer uses privileged global installation, mutable remote dependencies, and references a missing CLI wrapper, so it needs review before use.

Review this skill before installing. It is not showing malicious behavior, but running the installer will build a Docker image from unpinned upstream content and attempt a privileged global install. Prefer a user-local install path, pin and review dependencies, and confirm the missing scripts/transcribe wrapper is supplied or fixed before use.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: scripts/install.sh:16

Finding

Unpinned Remote Dependencies Make Builds Non-Reproducible and Expose the Image to Supply-Chain Compromise

Content

View full analysis

Vulnerability Details

File Location: scripts/install.sh, lines 16-23
Vulnerability Type: Unpinned third-party image, Python package, and model dependencies
Risk Level: Medium

Vulnerable Code

dockerfile

FROM python:3.11-slim

WORKDIR /app

RUN pip install --no-cache-dir faster-whisper

# Pre-download the model (small for speed, change to large-v3 for accuracy)
RUN python3 -c "from faster_whisper import WhisperModel; WhisperModel('small', device='cpu', compute_type='int8')"

Technical Analysis

The Docker base image is referenced through the mutable python:3.11-slim tag rather than an immutable digest. The installation of faster-whisper also omits an exact version and cryptographic hashes. Finally, the Whisper model is selected only by the mutable name small, without pinning or verifying a specific model revision.

As a result, identical executions of the installer can retrieve materially different content. The Docker build executes installation and model-loading code obtained from external package, container, and model infrastructure. Compromise of an upstream account, registry, package release, transitive dependency, or model source could therefore alter the generated image after this Skill has been reviewed.

Attack Path

1. An attacker compromises an upstream container tag, Python package, transitive dependency, package publisher, or model distribution source.
2. The attacker publishes modified content under an identifier used by the installer, such as python:3.11-slim, the latest available faster-whisper release, or the small model.
3. A user executes scripts/install.sh.
4. docker build retrieves the mutable base image and pip retrieves the unpinned package and dependencies.
5. The subsequent Python build step imports faster_whisper and initializes the model, executing compromised package code during image construction.
6. The resulting whisper:local image re ...[truncated 732 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin the base image to an audited immutable digest:

   dockerfile

   FROM python:3.11-slim@sha256:REVIEWED_DIGEST
   

2. Pin faster-whisper and every relevant transitive dependency to reviewed versions.

3. Use a lock file or requirements file containing cryptographic hashes, and install with hash enforcement:

   dockerfile

   COPY requirements.txt /app/requirements.txt
   RUN pip install --no-cache-dir --require-hashes -r /app/requirements.txt
   

4. Pin the model to an immutable repository revision or commit and verify expected artifact checksums before loading it.

5. Build in a restricted environment without sensitive credentials, host mounts, or unnecessary network access.

6. Generate and review a software bill of materials, scan the resulting image, and periodically update pins through a controlled review process.

T09 · Insecure Skill Coding Practices

Note

• Location: scripts/install.sh:10

Finding

Unsafe EXIT Trap Permits Shell Command Injection Through the Temporary Directory Path

Content

View full analysis

Vulnerability Details

File Location: scripts/install.sh, line 10
Vulnerability Type: Shell command injection caused by evaluating an unquoted path as trap code
Risk Level: Low

Vulnerable Code

bash

trap "rm -rf $BUILD_DIR" EXIT

Technical Analysis

BUILD_DIR is interpolated directly into a string registered as an EXIT trap. Bash later evaluates that string as shell code. Although BUILD_DIR originates from mktemp -d, the generated path can be affected by environment configuration such as TMPDIR.

If an attacker can arrange for the returned path to contain shell syntax, whitespace, or command substitutions, the trap string may be interpreted as multiple commands when the script exits. The command also lacks the -- option and does not preserve the path as a single quoted argument.

Exploitation requires control over the installer environment and the ability to provide a usable temporary-directory path containing malicious shell syntax. This limits practical exposure, but the cleanup construction is unnecessarily unsafe.

Attack Path

1. An attacker gains control over environment variables supplied to the installer, particularly temporary-directory configuration such as TMPDIR.
2. The attacker prepares a writable temporary-directory path whose name contains shell syntax and causes mktemp -d to return a derived malicious path.
3. The script interpolates that path into the trap body without shell-safe quoting.
4. The installer exits normally or after an error.
5. Bash evaluates the stored trap text, and the injected shell command executes with the privileges of the user running install.sh.

Impact Assessment

Successful exploitation permits arbitrary command execution with the privileges of the installer process. In the normal documented invocation, this is the invoking user's account and does not directly inherit the privileges of the separate sudo cp and sudo chmod c ...[truncated 296 chars]

Remediation

View remediation

Remediation Suggestions

Register a fixed cleanup function rather than constructing executable trap text from a path:

bash

BUILD_DIR="$(mktemp -d)"

cleanup() {
    rm -rf -- "$BUILD_DIR"
}

trap cleanup EXIT

Additional hardening measures:

1. Validate that BUILD_DIR is non-empty and has the expected temporary-directory prefix before deletion.
2. Use -- before the path so a value beginning with a hyphen cannot be interpreted as an option.
3. Quote every filesystem path expansion.
4. Run the installer itself without elevated privileges and restrict privilege elevation to the smallest required installation operation.
5. Consider rejecting unsafe or unexpected temporary-directory configurations when the script may execute in a privileged automation environment.

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (4)

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 95% confidence

Finding

The skill documents shell-based installation and execution behavior but does not declare any tool scope such as allowed-tools or permissions. That mismatch increases the chance an agent can invoke shell actions without explicit governance, review, or least-privilege constraints, which is especially relevant here because the workflow includes running install scripts, Docker builds, and CLI commands on local files.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · scripts/install.sh (reported line 67)May include surrounding context.

sh

docker build -t whisper:local "$BUILD_DIR"

echo "Installing transcribe CLI..."
sudo cp "$SCRIPT_DIR/transcribe" /usr/local/bin/transcribe
sudo chmod +x /usr/local/bin/transcribe

echo "✅ Done! Use: transcribe <audio_file> [language]"

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · scripts/install.sh (reported line 68)May include surrounding context.

sh

docker build -t whisper:local "$BUILD_DIR"

echo "Installing transcribe CLI..."
sudo cp "$SCRIPT_DIR/transcribe" /usr/local/bin/transcribe
sudo chmod +x /usr/local/bin/transcribe

echo "✅ Done! Use: transcribe <audio_file> [language]"

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The markdown explicitly states a default language of es (Spanish), which imposes a locale choice unless the caller overrides it. Under the policy rules, forcing a specific language without user opt-in is a natural-language policy concern, even though auto and explicit language options are also available.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.