Auto Whisper Safe

• Outcome: Pass
• Latest audit: Sep 10, 2026 · 7:00 PM UTC
• Version: 1.1.0

Overview

This skill coherently provides local audio transcription with temporary chunking and no evidence of hidden data access, persistence, or exfiltration.

Install dependencies from trusted package sources, preferably in a virtual environment, and consider pinning openai-whisper if reproducibility matters. Treat audio and generated transcripts as potentially sensitive local files, choose a private output directory, and set WHISPER_LANG explicitly for non-English audio because the script help text has a default-language mismatch.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:81

Finding

Unpinned Third-Party Package Installation

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:81-86
Vulnerability Type: Unpinned third-party dependency
Risk Level: Medium

Vulnerable Code

bash

# Ubuntu/Debian
pip install openai-whisper
apt install ffmpeg

Technical Analysis

The installation instructions retrieve openai-whisper from PyPI without pinning a reviewed version or verifying an integrity hash. The package version and its transitive dependency graph may therefore change after the Skill has been audited.

If the upstream package, maintainer account, release process, or resolved dependency is compromised, a user following these instructions could install attacker-controlled code. Python packages may execute code during installation, and installed malicious code may also execute when the whisper command is invoked.

The system-package command also does not pin a version, although packages obtained from a correctly configured and trusted operating-system repository generally receive stronger repository-level authenticity verification.

Attack Path

1. An attacker compromises the upstream PyPI project, a maintainer account, the release pipeline, or a transitive dependency resolved by openai-whisper.
2. The attacker publishes a malicious release that satisfies the unpinned installation command.
3. A user follows the documented pip install openai-whisper instruction.
4. Pip resolves and installs the malicious or compromised release.
5. Attacker-controlled code executes during package installation or when the Skill later invokes the installed whisper command.

Impact Assessment

Successful exploitation could permit arbitrary code execution with the privileges of the user performing installation or transcription. Depending on that user's access, the attacker could read or modify accessible files, obtain environment-held secrets, alter local tools, access transcription inputs and outputs, or establish further compromise.

The affected scope is the installat ...[truncated 270 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin openai-whisper and all transitive Python dependencies to reviewed versions in a lock file.
2. Require cryptographic hashes during installation, for example:

bash

python -m pip install --require-hashes -r requirements.txt

3. Generate requirements.txt from a trusted environment and include exact versions and SHA-256 hashes for every resolved package.
4. Install dependencies inside a dedicated virtual environment rather than the system Python environment.
5. Document the expected package source and configure pip to use only trusted indexes.
6. Consider pinning the operating-system package version where reproducibility is required, while continuing to rely on repository signature validation and security-update procedures.
7. Establish a dependency-update process that reviews and tests new versions before updating the lock file.

SkillSpector

Vulnerability Patterns

• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (4)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The documentation promotes transcription and temporary chunking/cleanup behavior but does not warn users that sensitive audio content will be written to disk as transcript outputs and intermediate files during processing. For voice messages, recordings may contain private or regulated data, so undisclosed at-rest persistence increases confidentiality and data-handling risk, especially on shared systems or where temp directories are backed up or monitored.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The environment variable table specifies WHISPER_LANG defaulting to en, which imposes a specific language choice unless the user overrides it. This is a natural-language locale policy concern because the documentation does not present the language setting as an explicit opt-in or justify why English is the default.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 82% confidence

Finding

The script sets WHISPER_LANG to en by default at L011, while the usage text at L018 says the default is de. This inconsistency can cause the skill to transcribe in English without the user's explicit choice, which is a locale/language behavior mismatch visible in natural-language text and comments.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The script sets LANG from WHISPER_LANG with a fallback of en at L011, but the usage/help text says the default is de at L018. This is an active contradiction in the script's inline documentation about runtime behavior.

Content

No source excerpt is available for this finding.