Security audit

Lx Whisper Transcribe

Security checks for vulnerabilities and agentic risk

Overview

This speech-to-text skill appears aimed at local transcription, but its setup understates network downloads, uses a different runtime than advertised, and makes persistent shell changes.

Review before installing. Only use it if you are comfortable downloading models from hf-mirror.com or Hugging Face, running a Python faster_whisper wrapper despite the whisper.cpp wording, and making a persistent ~/bin/whisper plus ~/.bashrc PATH change. Prefer a temporary PATH or virtual environment, verify downloaded model sources where possible, and remove the wrapper and ~/.bashrc line if you stop using it.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (4)

Description-Behavior Mismatch

Medium

Confidence: 95% confidence
Finding: The guide claims the solution works 'completely offline' while explicitly instructing users to verify network access and download model files from a remote mirror. This is a security-relevant documentation integrity issue because users may trust a false privacy/supply-chain assumption and unknowingly permit outbound network access to an untrusted third-party mirror.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: Appending to ~/.bashrc creates a persistent environment change that affects future shells, but the guide does not warn users that it permanently modifies startup configuration. In a skill context, silent persistence increases risk because a user may not realize a tool installed for one task will keep influencing command resolution later.

Vague Triggers

Medium

Confidence: 90% confidence
Finding: The phrase indicating activation on 'similar keywords' creates an open-ended trigger surface that can cause the skill to run when the user did not clearly request transcription. In an agent environment with filesystem read/write and command execution privileges, unintended activation increases the chance of processing sensitive audio or invoking local tooling unexpectedly.

Overly Broad Trigger

Low

Category: Trigger Abuse
Confidence: 80% confidence
Finding: The trigger '听写' is short and ambiguous, making accidental activation more likely in normal conversation. While the direct impact is limited, unintended invocation of a transcription skill with exec and filesystem permissions can still lead to unnecessary local processing of user audio or other workflow confusion.

Static analysis

No suspicious patterns detected.