Faster Whisper Transcription

• Outcome: Review
• Latest audit: Sep 10, 2026 · 9:56 PM UTC
• Version: 1.0.0

Overview

The skill is a coherent local voice transcription helper, but its install instructions use an unpinned package install that bypasses Python system-package protections.

Review before installing. Prefer a virtual environment or pipx-style isolated install, pin reviewed dependency versions, and avoid running the install command with sudo or root privileges. Treat the missing `voice-transcribe` implementation as an uncertainty about exactly how audio files are processed.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:6

Finding

Unpinned Dependency Installation Bypasses System Package Protections

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 6-8
Vulnerability Type: Unpinned third-party dependency installed outside an isolated environment
Risk Level: Medium

Vulnerable Code

bash

pip3 install --break-system-packages faster-whisper

Technical Analysis

The documented installation command retrieves faster-whisper without specifying an exact version or validating package hashes. Consequently, the installed package and its transitive dependencies may vary over time and are not cryptographically tied to versions reviewed by the project.

The --break-system-packages option disables Python's externally managed environment safeguard. Depending on the user's Python configuration and filesystem permissions, this can allow pip-managed packages to conflict with or replace components expected to remain under the operating system package manager's control.

Although the audited file provides no evidence that faster-whisper itself is malicious, the installation pattern increases exposure to a future upstream compromise, malicious dependency release, or incompatible dependency update. The project also contains no lock file or executable implementation through which the installed components and the documented voice-transcribe command can be verified.

Attack Path

1. An attacker compromises an upstream package account, distribution artifact, or transitive dependency used by an unconstrained release.
2. A user follows the documented installation command.
3. Pip resolves and downloads the currently available, unpinned package set.
4. Package build or installation logic executes with the invoking user's privileges.
5. A malicious dependency can access data available to that user, modify user-writable files, or alter the Python environment. If the command is run from an elevated account, the resulting scope can be correspondingly greater.
6. Because system package protections were explicitl ...[truncated 787 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove --break-system-packages and install the dependency in a dedicated virtual environment or managed tool environment such as pipx.

2. Pin faster-whisper and all transitive dependencies to reviewed versions using a lock file.

3. Generate and enforce cryptographic hashes, for example with a hash-locked requirements file and pip install --require-hashes.

4. Document a reproducible installation process, such as:

   bash

   python3 -m venv .venv
   . .venv/bin/activate
   python3 -m pip install --require-hashes -r requirements.txt
   

5. Obtain packages only from an explicitly configured trusted index and review updates before changing pinned versions.

6. Include the voice-transcribe implementation in the project, or clearly identify its trusted source and installation process, so reviewers can verify how local audio paths are processed and whether any data leaves the host.

7. Advise users not to perform dependency installation as root or through sudo.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Static analysis

No suspicious patterns detected.