Wjs Transcribing Audio

• Outcome: Review
• Latest audit: Sep 16, 2026 · 8:12 AM UTC
• Version: 0.1.0

Overview

The skill is a real transcription workflow, but it under-scopes credential handling while running unpinned tools and sending user audio to outside services.

Review this skill before installing. It appears intended for transcription, not deception, but use it only with non-sensitive audio or with explicit consent, avoid sourcing a broad shared .env file, pass only the required ASR credential to the active command, and pin or preinstall the runtime dependencies in a trusted environment.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:133

Finding

Shared Environment File Exposes Unrelated Credentials to Child Processes

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:133
Vulnerability Type: Broad credential exposure through indiscriminate environment export
Risk Level: High

Vulnerable Code Snippet:

markdown

- **Auth:** credentials live in `~/code/.env`. Load with `set -a; source ~/code/.env; set +a` before invoking.

Technical Analysis

The instruction uses set -a before sourcing the shared ~/code/.env file. This causes every variable assigned by that file to be exported into the environment, not merely the OPENAI_API_KEY, VOLC_ASR_APPID, and VOLC_ASR_ACCESS_TOKEN values required by the declared transcription workflow.

Every subsequently launched process inherits these exported values by default. The skill also recommends executing dynamically resolved Python dependencies through uvx, substantially increasing the consequences of exposing the complete environment to child processes.

This exceeds least privilege because the skill only needs credentials for the selected ASR provider. It does not require access to every secret stored in the user's shared environment file.

Attack Path

1. The operator follows the skill instruction and runs set -a.
2. The shared ~/code/.env file is sourced.
3. All variables defined by the file, including credentials unrelated to transcription, are exported.
4. The operator launches Python, uvx, httpx, Whisper, or another child process as part of the workflow.
5. A compromised, malicious, or vulnerable dependency reads inherited secrets through the process environment.
6. The dependency can transmit those secrets over the network or use them to access associated services.

Exploitation is conditional on untrusted code executing after the environment is exported, but the skill's unpinned runtime dependency instructions provide a credible route for that condition to occur.

Impact Assessment

An executing child process could obtain all credentials ex ...[truncated 450 chars]

Remediation

View remediation

Remediation Suggestions

• Do not use set -a with a shared environment file.
• Store transcription credentials in a dedicated file containing only the required ASR variables and restrict its permissions, for example to owner read/write access.
• Pass only the credential required for the selected provider to the relevant process.
• Run OpenAI and Volcano operations in separate, narrowly scoped environments.
• Clear temporary environment variables immediately after the API operation.
• Ensure subprocesses that do not require credentials receive a sanitized environment.
• Prefer a platform secret manager or credential helper that can provide a single secret to a specific process without exposing unrelated values.
• Document the exact required variables: OPENAI_API_KEY for OpenAI, or VOLC_ASR_APPID and VOLC_ASR_ACCESS_TOKEN for Volcano.

T08 · Insecure Dependencies

Error

• Location: SKILL.md:134

Finding

Unpinned Third-Party Packages Are Dynamically Resolved and Executed

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:134 and SKILL.md:165-168
Vulnerability Type: Unpinned runtime dependency execution
Risk Level: High

Vulnerable Code Snippets:

markdown

- **SOCKS proxy on this machine:** `httpx` needs the `socksio` extra — use `uvx --with httpx --with socksio python ...` (without it you get `ImportError: Using SOCKS proxy, but the 'socksio' package is not installed`).

bash

uvx --from openai-whisper whisper _audio.wav \
    --language zh --task transcribe \
    --model medium --output_format srt --output_dir .
rm _audio.wav

Technical Analysis

The skill instructs the operator to use uvx to resolve and execute httpx, socksio, and openai-whisper without version constraints, hashes, a lockfile, or an explicitly trusted package index.

Consequently, the code executed by a future invocation can differ from the code present when the skill was audited. Package updates, registry compromise, dependency confusion, or compromise of a transitive dependency could introduce arbitrary code into the transcription process.

The risk is amplified by the credential-loading instruction at line 133. If the shared environment has first been exported, package installation hooks or imported package code may inherit all exported credentials. The packages also process user-provided media and execute with the invoking user's filesystem and network permissions.

This is a supply-chain weakness rather than confirmed malicious package behavior. The audited file contains no evidence that the named packages are currently malicious.

Attack Path

1. An attacker compromises a named package, one of its transitive dependencies, or the package distribution channel.
2. A malicious release is published under a version accepted by the unconstrained uvx invocation.
3. The operator invokes the skill after the malicious release becomes resolvable.
4. uvx obtains or select ...[truncated 1126 chars]

Remediation

View remediation

Remediation Suggestions

• Pin every direct dependency to a reviewed version, including httpx, socksio, and openai-whisper.
• Pin transitive dependencies through a lockfile and verify package hashes.
• Configure a trusted package index or an internally controlled mirror rather than relying on unconstrained default resolution.
• Build and test a dedicated, immutable virtual environment or container instead of resolving packages each time the skill runs.
• Scan pinned dependencies for known vulnerabilities and review updates before deployment.
• Run transcription tools with a sanitized environment containing only the credential required for the current operation.
• Restrict filesystem and network access through sandboxing or container controls.
• Avoid exposing credentials during package installation; install dependencies before injecting runtime secrets.
• Separate dependency acquisition from media processing so package installation code cannot access user recordings or provider credentials.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (6)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The skill directs uploading audio chunks to external transcription APIs but does not clearly warn that potentially sensitive user audio will leave the local environment and be processed by third parties. In a transcription context, this is materially dangerous because audio often contains personal, confidential, or regulated content.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 90% confidence

Finding

This code performs an outbound upload of chunk.mp3 to the OpenAI transcription API, which is an external transmission of user-provided content. While the feature is intentional, it is still security-relevant because it transfers potentially sensitive media and associated metadata off-box to a third-party service.

Content

Scanner excerpt · SKILL.md (reported line 67)May include surrounding context.

md

"temperature": "0.2",                    # enable fallback chain (anti-loop)
}
with open("chunk.mp3", "rb") as f:
    r = httpx.post(
        "https://api.openai.com/v1/audio/transcriptions",
        headers={"Authorization": f"Bearer {os.environ['OPENAI_API_KEY']}"},
        data=data,

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 88% confidence

Finding

The explicit reference to https://api.openai.com/v1/audio/transcriptions confirms third-party network transmission. In this skill's context, that is expected behavior, but it still represents a real privacy/security concern because user audio content and authentication tokens are involved.

Content

Scanner excerpt · SKILL.md (reported line 68)May include surrounding context.

md

}
with open("chunk.mp3", "rb") as f:
    r = httpx.post(
        "https://api.openai.com/v1/audio/transcriptions",
        headers={"Authorization": f"Bearer {os.environ['OPENAI_API_KEY']}"},
        data=data,
        files={"file": ("chunk.mp3", f, "audio/mpeg")},

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill explicitly instructs loading credentials from ~/code/.env into the shell environment without a user-facing warning or least-privilege guidance. This increases the risk of accidental secret exposure to subprocesses, logs, or unrelated commands invoked during the workflow.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 86% confidence

Finding

The skill instructs use of uvx --with httpx without pinning an exact package version, which creates a supply-chain risk: a future or maliciously replaced dependency version could be fetched and executed at runtime. This is more concerning here because the same workflow also loads local credentials and may operate in environments with proxy/network access, increasing the blast radius of compromised transient tooling.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 89% confidence

Finding

The command uvx --from openai-whisper whisper ... installs and executes an unpinned package, exposing the system to dependency confusion or malicious upstream updates. Because this command processes user media and is run locally, a compromised package could execute arbitrary code with the user's privileges.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.