DeepGram Speech platform

• Outcome: Pass
• Latest audit: Sep 10, 2026 · 8:33 AM UTC
• Version: 1.0.1

Overview

This is a coherent Deepgram speech-to-text CLI guide, but users should understand that audio and microphone input may be processed by Deepgram and that the install command uses a global npm package.

Install only if you trust the Deepgram CLI package and are comfortable sending selected audio, URLs, stdin streams, or microphone input to Deepgram for transcription. Prefer a pinned or isolated install when possible, use a revocable API key, and avoid transcribing sensitive or regulated audio unless your Deepgram account settings and policy obligations allow it.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:8

Finding

Unpinned Global npm Package Installation

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 8-11
Vulnerability Type: Unpinned third-party dependency installed globally
Risk Level: Medium

Vulnerable Code

bash

## Install
```bash
npm install -g @deepgram/cli

text

### Technical Analysis

The documented installation command retrieves the current version of `@deepgram/cli` from the configured npm registry without pinning a reviewed version or verifying package integrity. Consequently, the code installed by this instruction can change after the Skill has been audited.

npm installation may execute package lifecycle scripts with the invoking user's permissions. The global installation flag (`-g`) also expands the package's presence and potential impact beyond an isolated project environment. Although the package name is consistent with the Skill's stated Deepgram functionality and the audited file contains no direct evidence that the package is malicious, this installation pattern creates a supply-chain exposure.

### Attack Path

1. An attacker compromises the upstream package, a maintainer account, the configured npm registry, or a future package release.
2. The attacker publishes a modified release containing a malicious lifecycle script or executable payload.
3. A user follows the Skill's unpinned `npm install -g` instruction.
4. npm retrieves the mutable current release rather than a previously reviewed version.
5. Malicious lifecycle code may execute during installation, or malicious CLI code may execute when the user subsequently invokes `deepgram`.
6. The payload operates with the permissions of the user running npm and can access resources available to that account.

### Impact Assessment

Successful exploitation could permit arbitrary code execution with the installing user's privileges. Depending on that user's permissions, exposed resources may include local files, environment variables, the locally stored Deepgram API cred
...[truncated 261 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin @deepgram/cli to an explicitly reviewed version rather than installing the mutable latest release.
2. Prefer a project-local dependency governed by a committed lockfile over a global installation.
3. Verify the package's registry provenance, publisher identity, signatures or attestations where available, and expected integrity metadata before adoption.
4. Review package lifecycle scripts and release changes before updating the pinned version.
5. Install and execute the CLI using a least-privileged account; do not instruct users to run npm with sudo or elevated privileges.
6. Consider an isolated environment or container with narrowly scoped filesystem and credential access.
7. Document where the Deepgram API key is stored and require restrictive file permissions and a narrowly scoped, revocable credential.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The skill encourages transcription of local files, URLs, STDIN, and live microphone audio but never warns that the content is sent to Deepgram's remote service for processing. This omission can cause users to transmit sensitive conversations, credentials, regulated data, or internal media off-device without informed consent, especially in automated or microphone-based workflows.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.