Security audit
Security checks for vulnerabilities and agentic risk
This skill is a straightforward audio transcription wrapper that sends a user-selected audio file to OpenAI and saves the transcript locally.
Install only if you are comfortable sending the selected audio files to OpenAI for transcription. Avoid using it for recordings that contain confidential, regulated, or non-consented speech unless that use is allowed for your situation and account settings.
The skill declares shell-based execution (scripts/transcribe.sh) but does not define any tool scope such as permissions or allowed-tools. In agent environments, undeclared shell capability weakens policy enforcement and can let the skill execute commands with broader access than users or hosts expect.
The skill instructs users to transcribe local audio through OpenAI's /v1/audio/transcriptions endpoint but does not clearly warn that the audio content is uploaded to a third-party remote service. This omission can cause unintentional disclosure of sensitive recordings, especially because audio often contains personal, confidential, or regulated data.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
mkdir -p "$(dirname "$out")"
curl -sS https://api.openai.com/v1/audio/transcriptions \
-H "Authorization: Bearer $OPENAI_API_KEY" \
-H "Accept: application/json" \
-F "file=@${in}" \
No suspicious patterns detected.