音频转文字

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 10:02 AM UTC
• Version: 1.0.2

Overview

This is a coherent Baidu cloud audio transcription skill, but users should treat uploaded audio and Baidu API credentials as sensitive.

Install only if you are comfortable sending selected audio files to Baidu Smart Cloud for transcription. Prefer environment variables or a secret manager for API credentials, avoid putting secrets in shell history or committed config files, and use non-sensitive test audio first. Pin and review Python dependencies in a virtual environment before production use.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

• Location: audio_to_text.py:92

Finding

Baidu API credentials may be exposed through command-line arguments and OAuth query parameters

Content

View full analysis

Vulnerability Details

File Location: audio_to_text.py:92-100, audio_to_text.py:426-427, SKILL.md:31-32, README.md:58-59
Vulnerability Type: Sensitive credential exposure
Risk Level: Medium

Complete Code Snippets

audio_to_text.py:92-100:

python

url = "https://aip.baidubce.com/oauth/2.0/token"
params = {
    "grant_type": "client_credentials",
    "client_id": self.api_key,
    "client_secret": self.secret_key
}

try:
    response = requests.get(url, params=params)

audio_to_text.py:426-427:

python

parser.add_argument('--api-key', help='Baidu API Key', default=os.getenv('BAIDU_API_KEY'))
parser.add_argument('--secret-key', help='Baidu Secret Key', default=os.getenv('BAIDU_SECRET_KEY'))

The documentation recommends passing credentials directly on the command line:

bash

python audio_to_text.py \
  --api-key YOUR_API_KEY \
  --secret-key YOUR_SECRET_KEY

Technical Analysis

The Skill legitimately requires Baidu API credentials to obtain an access token. However, accepting and recommending secrets as command-line arguments exposes them to shell history and, depending on the operating system and process isolation settings, process inspection tools.

The token request also sends client_secret through the query parameters of an HTTP GET request. HTTPS protects the request in transit from passive network observers, but the complete URL can still be recorded by local debugging infrastructure, HTTP proxies, application-performance monitoring systems, or server-side access logs. Query strings are generally more likely to be retained than request bodies.

This behavior does not grant the Skill broader system privileges, and transmitting credentials to Baidu is necessary for the declared speech-recognition function. Nevertheless, the selected credential-handling mechanisms exceed the minimum exposure necessary to authenticate.

Attack Path

1. A u ...[truncated 1312 chars]

Remediation

View remediation

Remediation Suggestions

1. Stop recommending command-line arguments for secrets. Prefer environment variables, operating-system credential stores, or a dedicated secret manager.
2. If configuration files remain supported, require restrictive filesystem permissions and clearly warn users not to commit credential-bearing files.
3. If supported by Baidu's OAuth endpoint, send the token request as an HTTPS POST with credentials in a form-encoded request body rather than a GET query string.
4. Ensure HTTP clients, proxies, exception handlers, and telemetry systems redact client_id, client_secret, access tokens, and credential-bearing URLs.
5. Consider deprecating --secret-key, or support a secure interactive prompt that does not echo or persist the supplied secret.
6. Rotate any credential that may already have appeared in command histories or logs.
7. Add explicit network timeouts to the token and recognition requests to prevent indefinite blocking while hardening the request code.

T08 · Insecure Dependencies

Note

• Location: requirements.txt:1

Finding

Unbounded Requests dependency creates non-reproducible and unsafe dependency resolution

Content

View full analysis

Vulnerability Details

File Location: requirements.txt:1
Vulnerability Type: Unpinned third-party dependency
Risk Level: Low

Complete Code Snippet

requirements.txt:1:

text

requests>=2.25.0

The documented installation command resolves this unrestricted dependency:

bash

pip install -r requirements.txt

Technical Analysis

The lower-bound-only constraint permits the package manager to install any current or future version of requests. Consequently, installations performed at different times may receive materially different code that was not included in the audited Skill package.

The dependency name is legitimate and no typosquatting or malicious package was identified in the reviewed files. The risk arises from the absence of an upper bound, lock file, and integrity hashes. A compromised future release, compromised package-distribution account, or incompatible update could alter the Skill's network behavior when imported and used.

Attack Path

1. A user installs the Skill's dependencies with pip install -r requirements.txt.
2. The resolver selects the newest release satisfying requests>=2.25.0.
3. If that release or one of its resolved transitive dependencies is compromised, unreviewed code is installed into the environment.
4. The Skill imports requests when audio_to_text.py runs.
5. Malicious dependency code can execute with the permissions of the user running the Skill and potentially observe the credentials and audio processed by that runtime.

This attack path requires a compromised upstream release, package-distribution account, package index, or dependency resolution environment; no such compromise was found in the project itself.

Impact Assessment

A compromised dependency would execute with the same operating-system privileges as the Skill process. It could potentially read accessible files, capture Baidu API credentials and audio content ...[truncated 326 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin requests to a reviewed exact version instead of using only a lower bound.
2. Generate and commit a dependency lock file that includes resolved transitive dependencies.
3. Require package hashes during installation, for example through a hash-locked requirements file and pip --require-hashes.
4. Use automated dependency scanning and controlled update reviews to keep pinned versions patched.
5. Install dependencies in an isolated virtual environment with only the filesystem and network access required by the Skill.
6. Use a trusted package index and prevent unreviewed fallback to arbitrary package repositories.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (15)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The README states the skill uses Baidu Cloud speech recognition but does not clearly warn users that their audio content will be transmitted to and processed by a third-party service. This can cause users to unknowingly upload sensitive voice recordings, personal data, or confidential business information, creating privacy, compliance, and consent risks.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill explicitly sends user audio to Baidu's cloud speech-recognition API, but the description does not clearly warn users that audio content leaves the local environment and is transmitted to a third party. This can lead to accidental disclosure of sensitive conversations, personal data, or regulated content because users may assume processing is local unless told otherwise.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The examples encourage passing API credentials on the command line and storing them in a JSON config file without warning that these methods can expose secrets via shell history, process listings, shared terminals, checked-in files, or insecure local storage. This increases the risk of credential theft and subsequent unauthorized use of the Baidu account and associated billing or data access.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The code sends full audio content and associated metadata to Baidu's external speech-recognition API via HTTP requests, but there is no explicit user-facing notice, consent step, or clear documentation at runtime that local audio will leave the environment. This creates a privacy and data-governance risk, especially if users process sensitive recordings without realizing they are being uploaded to a third party.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · long_audio_processor.py (reported line 57)May include surrounding context.

python

audio_path
            ]

            result = subprocess.run(cmd, stdout=subprocess.PIPE, stderr=subprocess.PIPE, universal_newlines=False, check=True)
            # 解码输出，忽略编码错误
            stdout_decoded = result.stdout.decode('utf-8', errors='ignore')
            info = json.loads(stdout_decoded)

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · long_audio_processor.py (reported line 207)May include surrounding context.

python

]

        logger.info(f"Converting audio with ffmpeg: {' '.join(ffmpeg_cmd)}")
        result = subprocess.run(ffmpeg_cmd, capture_output=True, text=True, check=True)

        if result.returncode != 0:
            raise Exception(f"ffmpeg conversion failed: {result.stderr}")

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

This path sends audio segments to an external recognizer service, which can expose sensitive voice content, background speech, and personal data to a third party without any disclosure or consent handling in this module. In a skill context, silent exfiltration of user-provided content to an external service is a real privacy and compliance risk even if it is functionally intended.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The short-audio path has the same privacy issue: it forwards user audio to an external recognizer without any warning, consent, or policy enforcement visible in this file. Because voice recordings may contain sensitive or identifying information, this creates data-sharing risk and potential regulatory exposure.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The manifest explicitly states that audio will be sent to Baidu Cloud speech recognition, but it provides no user-facing warning that potentially sensitive voice data leaves the local system and is transmitted to a third party. Audio content often contains personal, confidential, or regulated information, so silent cloud transmission creates a meaningful privacy and compliance risk even if it is functionally required for the skill.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

This code file contains user-facing natural-language documentation in a single language, which can violate language/locale policy when no opt-in or alternative is provided. Nothing in the file indicates the skill is intentionally limited to Chinese-speaking users or a region-specific context.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 82% confidence

Finding

Natural-language strings in the file, including the top-level description and CLI help text, assume a Chinese-language user experience by default. Under the policy, forcing a specific language without user opt-in can be a locale-policy violation unless the restriction is explicitly justified or users are given a choice.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 80% confidence

Finding

The top-level natural-language documentation is entirely in Chinese and does not offer any language choice or explain a locale-specific requirement. Under the stated policy, forcing a specific language without user opt-in can be a language/locale policy violation.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 96% confidence

Finding

The dependency is specified as requests>=2.25.0, which allows any newer version to be installed without ensuring a reviewed, reproducible, and known-safe release. This weakens supply-chain control and can result in builds pulling vulnerable or behavior-changing versions over time.

Content

Scanner excerpt · requirements.txt (reported line 1)May include surrounding context.

text

requests>=2.25.0

Unverifiable Dependency: requests has 16 known advisory(ies) (CVE-2014-1830 (Exposure of Sensitive Information to an Unauthorized Actor in Requests); CVE-2024-47081 (Requests vulnerable to .netrc credentials leak via malicious URLs); CVE-2024-35195 (Requests `Session` object does not verify requests after making first request wi) +13 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 93% confidence

Finding

The manifest references requests without pinning to a specific version, while the package has multiple known advisories across releases. Because the resolved version is unconstrained above 2.25.0, deployments may install an affected version and expose the skill to known issues such as credential leakage or TLS/request validation flaws depending on runtime resolution.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 76% confidence

Finding

The docstring describes concrete behavior—splitting long audio and transcribing with Baidu's API—while this file itself only loads modules, enumerates local audio files, and calls process_long_audio on them. That is an intent/documentation mismatch within this file, because the documented direct behavior is broader than what the code shown actually implements.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.