Wjs Transcribing Audio

• Analyzed: May 13, 2026, 1:36 PM
• Findings: 1
• Version: 0.1.0
• Hash: f76f3e1c2b0567641df27ecb3336aa14366f3b31512291f4f1439869de0bdf12
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill 'wjs-transcribing-audio' (SKILL.md) provides logic for transcribing audio via OpenAI and Volcano APIs. It is classified as suspicious because it instructs the agent to perform high-risk actions, such as sourcing all environment variables from '~/code/.env' and executing shell commands ('ffmpeg') with potentially unsanitized input. While these behaviors are aligned with the stated purpose of audio processing and API interaction, they introduce vulnerabilities like shell injection and credential exposure. No evidence of intentional malice or unauthorized data exfiltration was found (IOC: api.openai.com).