Security audit

DeepGram Speech platform

Security checks across malware telemetry and agentic risk

Overview

This skill is a straightforward Deepgram CLI guide for speech-to-text, with privacy considerations around sending audio to Deepgram but no hidden or unrelated behavior.

Before installing, verify that @deepgram/cli is the intended Deepgram package, protect the stored API key, and only transcribe audio or live microphone input that you are authorized to send to Deepgram, especially if it includes confidential, personal, or regulated content.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (2)

Missing User Warnings

Medium

Confidence: 88% confidence
Finding: The skill instructs users to transcribe audio directly from a remote URL without warning that the referenced audio content will be fetched and sent to Deepgram's external service for processing. This can cause unintentional disclosure of sensitive audio or private URL-hosted media, especially if users assume the command only reads locally or do not realize third-party transmission is involved.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The microphone example encourages live capture from the user's environment without warning that spoken content and ambient audio may be recorded and transmitted to Deepgram. In practice, this can expose confidential conversations, personal data, or bystander speech if users start the command without understanding the privacy implications.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.