Voice To Protocol Transcriber

• Outcome: Review
• Latest audit: May 29, 2026, 9:24 PM
• Version:
  0.1.0

Overview

The skill mostly matches its lab-note purpose, but it under-discloses sensitive recording/storage behavior and has overly loose local file save handling.

Review this before installing if you may record proprietary, regulated, clinical, or personal information. Use an explicit secure save directory, avoid sensitive content unless storage is approved, and treat the speech-recognition/dependency documentation as incomplete until the publisher clarifies whether audio or transcripts leave the machine.

SkillSpector

By NVIDIA

Vulnerability Patterns

• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Intent-Code Divergence

Medium

• Confidence: 97% confidence
• Finding: The security section claims output is restricted to the workspace, but the configuration directs records to ~/Documents/Experiment-Protocols, an unrestricted user directory. This inconsistency can lead to sensitive experimental data being stored in broader, less controlled locations than users or reviewers expect.

Missing User Warnings

Medium

• Confidence: 84% confidence
• Finding: The skill handles microphone input and stores spoken experimental content, but the description lacks a prominent warning about capture and retention of potentially sensitive data. In wet-lab and clinical contexts, spoken observations may include proprietary, regulated, or personal information, so inadequate notice can cause accidental exposure or noncompliant data handling.

VirusTotal

47/47 vendors flagged this skill as clean.