MH openai-whisper-api

• Outcome: Pass
• Latest audit: May 28, 2026, 8:53 AM
• Version:
  1.0.0

Overview

This skill appears to do what it claims: upload a user-selected audio file to OpenAI Whisper for transcription.

Install only if you are comfortable sending selected audio files to OpenAI for transcription and using an OPENAI_API_KEY. Avoid processing confidential, regulated, or third-party recordings unless that upload is allowed by your policies.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (2)

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The script transmits the provided audio file to OpenAI's remote transcription API, but it does not present any explicit warning, consent prompt, or disclosure at runtime that local audio content will leave the host. This can cause unintentional disclosure of sensitive or regulated audio data, especially when the script is used as a reusable agent skill where users may assume processing is local.

External Transmission

Medium

• Category: Data Exfiltration

Content

mkdir -p "$(dirname "$out")"

curl -sS https://api.openai.com/v1/audio/transcriptions \
  -H "Authorization: Bearer $OPENAI_API_KEY" \
  -H "Accept: application/json" \
  -F "file=@${in}" \

• Confidence: 88% confidence
• Finding: https://api.openai.com/

VirusTotal

66/66 vendors flagged this skill as clean.