Security audit

Whisper STT

Security checks for vulnerabilities and agentic risk

Overview

This skill provides local Whisper transcription with disclosed setup steps and no evidence of hidden data access, persistence, or exfiltration.

Install this in an isolated Python environment, consider pinning dependency versions, and avoid running the demo or package installation with elevated privileges unless you intentionally need system-wide ffmpeg. Audio stays local according to the reviewed code, but Whisper models and dependencies may be downloaded by the underlying packages during setup or first use.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Note

Location: SKILL.md:17
Finding: Unpinned Third-Party Dependency Installation
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Note

Location: scripts/demo.sh:17
Finding: Predictable Shared Temporary File Permits Local File Interference
Content: View full analysis
/dev/null if [ ! -f "$test_audio" ]; then echo "❌ 无法创建测试音频 (say 命令不可用)" exit 1 fi # ... result=$(python3 "$SCRIPT_DIR/transcribe.py" "$test_audio" --model tiny --output txt 2>/dev/null) # ... rm -f "$test_audio" ``` ### Technical Analysis The demonstration script uses the constant path `/tmp/whisper_demo.aiff` in a shared temporary directory. It neither creates the file atomically nor verifies that it is a newly created regular file owned by the current user. The path is used at separate times for creation, existence checking, transcription, and deletion. A local process able to manipulate that pathname may pre-create it or replace it between operations. Depending on operating-system protections and the behavior of the `say` command, this can cause denial of service, processing of attacker-selected audio, or redirection of the output operation toward another file writable by the victim. The quoted shell variables prevent shell command injection, but quoting does not address pathname races or symbolic-link attacks. ### Attack Path 1. A local attacker predicts that the victim will run the demonstration script. 2. The attacker creates `/tmp/whisper_demo.aiff` or repeatedly replaces the path with an attacker-controlled file or symbolic link. 3. The victim runs `scripts/demo.sh`. 4. The `say` command writes through the shared pathname, or the path is replaced after creation and before transcription. 5. The script may transcribe attacker-selected content, fail unexpectedly, or overwrite a file to which the victim has write access. 6. The unconditional cleanup operation removes the pathname selected at cleanup time. Exploitation ...[truncated 753 chars]
Remediation: View remediation
&2 exit 1 fi ``` Additional hardening measures include: - Avoid reusing a global fixed filename. - Keep the temporary directory accessible only to the current user. - Preserve and check command exit statuses directly rather than relying only on later file-existence checks. - Do not run the demo with elevated privileges. ]]>

SkillSpector

Vulnerability Patterns

Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (2)

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
Content: Scanner excerpt · SKILL.md (reported line 24)May include surrounding context.
md
Optional: Install ffmpeg for broader format support: - macOS: `brew install ffmpeg` - Ubuntu: `sudo apt install ffmpeg` ## Usage

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The script title, status messages, and generated demo speech are presented in Chinese, including a hard-coded Chinese utterance in the test audio. This imposes a specific language/locale by default without user opt-in or justification that the skill is region-specific.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.