Auto Whisper Safe

• Outcome: Pass
• Latest audit: Sep 10, 2026 · 7:00 PM UTC
• Version: 1.1.0

Overview

This skill coherently provides local audio transcription with temporary chunking and no evidence of hidden data access, persistence, or exfiltration.

Install dependencies from trusted package sources, preferably in a virtual environment, and consider pinning openai-whisper if reproducibility matters. Treat audio and generated transcripts as potentially sensitive local files, choose a private output directory, and set WHISPER_LANG explicitly for non-English audio because the script help text has a default-language mismatch.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:81
• Finding: Unpinned Third-Party Package Installation## Vulnerability Details **File Location**: `SKILL.md:81-86` **Vulnerability Type**: Unpinned third-party dependency **Risk Level**: Medium ### Vulnerable Code ```bash # Ubuntu/Debian pip install openai-whisper apt install ffmpeg ``` ### Technical Analysis The installation instructions retrieve `openai-whisper` from PyPI without pinning a reviewed version or verifying an integrity hash. The package version and its transitive dependency graph may therefore change after the Skill has been audited. If the upstream package, maintainer account, release process, or resolved dependency is compromised, a user following these instructions could install attacker-controlled code. Python packages may execute code during installation, and installed malicious code may also execute when the `whisper` command is invoked. The system-package command also does not pin a version, although packages obtained from a correctly configured and trusted operating-system repository generally receive stronger repository-level authenticity verification. ### Attack Path 1. An attacker compromises the upstream PyPI project, a maintainer account, the release pipeline, or a transitive dependency resolved by `openai-whisper`. 2. The attacker publishes a malicious release that satisfies the unpinned installation command. 3. A user follows the documented `pip install openai-whisper` instruction. 4. Pip resolves and installs the malicious or compromised release. 5. Attacker-controlled code executes during package installation or when the Skill later invokes the installed `whisper` command. ### Impact Assessment Successful exploitation could permit arbitrary code execution with the privileges of the user performing installation or transcription. Depending on that user's access, the attacker could read or modify accessible files, obtain environment-held secrets, alter local tools, access transcription inputs and outputs, or establish further compromise. The affected scope is the installat ...[truncated 270 chars]
• Remediation: ## Remediation Suggestions 1. Pin `openai-whisper` and all transitive Python dependencies to reviewed versions in a lock file. 2. Require cryptographic hashes during installation, for example: ```bash python -m pip install --require-hashes -r requirements.txt ``` 3. Generate `requirements.txt` from a trusted environment and include exact versions and SHA-256 hashes for every resolved package. 4. Install dependencies inside a dedicated virtual environment rather than the system Python environment. 5. Document the expected package source and configure pip to use only trusted indexes. 6. Consider pinning the operating-system package version where reproducibility is required, while continuing to rely on repository signature validation and security-update procedures. 7. Establish a dependency-update process that reviews and tests new versions before updating the lock file.

SkillSpector

Vulnerability Patterns

• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (4)

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The documentation promotes transcription and temporary chunking/cleanup behavior but does not warn users that sensitive audio content will be written to disk as transcript outputs and intermediate files during processing. For voice messages, recordings may contain private or regulated data, so undisclosed at-rest persistence increases confidentiality and data-handling risk, especially on shared systems or where temp directories are backed up or monitored.

Natural-Language Policy Violations

Medium

• Confidence: 88% confidence
• Finding: The environment variable table specifies `WHISPER_LANG` defaulting to `en`, which imposes a specific language choice unless the user overrides it. This is a natural-language locale policy concern because the documentation does not present the language setting as an explicit opt-in or justify why English is the default.

Natural-Language Policy Violations

Low

• Confidence: 82% confidence
• Finding: The script sets `WHISPER_LANG` to `en` by default at L011, while the usage text at L018 says the default is `de`. This inconsistency can cause the skill to transcribe in English without the user's explicit choice, which is a locale/language behavior mismatch visible in natural-language text and comments.

Intent-Code Divergence

Low

• Confidence: 97% confidence
• Finding: The script sets `LANG` from `WHISPER_LANG` with a fallback of `en` at L011, but the usage/help text says the default is `de` at L018. This is an active contradiction in the script's inline documentation about runtime behavior.