Whisper STT

• Outcome: Pass
• Latest audit: Sep 11, 2026 · 1:19 AM UTC
• Version: 1.0.0

Overview

This skill provides local Whisper transcription with disclosed setup steps and no evidence of hidden data access, persistence, or exfiltration.

Install this in an isolated Python environment, consider pinning dependency versions, and avoid running the demo or package installation with elevated privileges unless you intentionally need system-wide ffmpeg. Audio stays local according to the reviewed code, but Whisper models and dependencies may be downloaded by the underlying packages during setup or first use.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Note

• Location: SKILL.md:17
• Finding: Unpinned Third-Party Dependency Installation<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:17` **Vulnerability Type**: Supply-chain exposure through unpinned dependencies **Risk Level**: Low ### Vulnerable Code ```bash pip install openai-whisper torch ``` ### Technical Analysis The documented installation command retrieves the latest available versions of `openai-whisper` and `torch` from the user's configured Python package index without version constraints or cryptographic hash verification. Consequently, the installed code can change independently of the reviewed skill. If a future package release, package-index account, configured mirror, or package-distribution channel is compromised, installation may introduce attacker-controlled code. Python packages can execute code during installation or later when imported by `scripts/transcribe.py`. No malicious dependency or unsafe custom package source is present in the reviewed project. This finding concerns the absence of reproducible dependency controls. ### Attack Path 1. An attacker compromises a dependency release, package-publisher account, configured Python package mirror, or related distribution channel. 2. The attacker publishes a malicious package version under the legitimate dependency name. 3. A user follows the documented unpinned `pip install` command. 4. `pip` resolves and installs the attacker-controlled release. 5. Malicious code executes during package installation or when `whisper` or `torch` is imported. 6. The code runs with the privileges of the user performing installation or transcription. ### Impact Assessment Successful exploitation could provide arbitrary code execution with the installing user's privileges. This may expose files, credentials, environment variables, transcription inputs, and other resources accessible to that account. The project does not request elevated installation privileges, so the direct scope is normally limited to the invoking user. Impact would be greater if the command were r ...[truncated 37 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Declare reviewed, exact dependency versions in a requirements or lock file. - Generate and verify cryptographic hashes for every package and transitive dependency, such as with `pip install --require-hashes`. - Install dependencies in an isolated virtual environment rather than a global or privileged Python environment. - Use a trusted package index or an internally controlled package mirror. - Regularly review and intentionally update pinned versions after security testing. - Document a reproducible installation command, for example: ```bash python3 -m venv .venv . .venv/bin/activate python3 -m pip install --require-hashes -r requirements.txt ``` ]]>

T09 · Insecure Skill Coding Practices

Note

• Location: scripts/demo.sh:17
• Finding: Predictable Shared Temporary File Permits Local File Interference<![CDATA[ ## Vulnerability Details **File Location**: `scripts/demo.sh:17-45` **Vulnerability Type**: Predictable temporary file and time-of-check/time-of-use exposure **Risk Level**: Low ### Vulnerable Code ```bash test_audio="/tmp/whisper_demo.aiff" say -o "$test_audio" "你好，这是 Whisper 语音识别的测试。Hello, this is a test." 2>/dev/null if [ ! -f "$test_audio" ]; then echo "❌ 无法创建测试音频 (say 命令不可用)" exit 1 fi # ... result=$(python3 "$SCRIPT_DIR/transcribe.py" "$test_audio" --model tiny --output txt 2>/dev/null) # ... rm -f "$test_audio" ``` ### Technical Analysis The demonstration script uses the constant path `/tmp/whisper_demo.aiff` in a shared temporary directory. It neither creates the file atomically nor verifies that it is a newly created regular file owned by the current user. The path is used at separate times for creation, existence checking, transcription, and deletion. A local process able to manipulate that pathname may pre-create it or replace it between operations. Depending on operating-system protections and the behavior of the `say` command, this can cause denial of service, processing of attacker-selected audio, or redirection of the output operation toward another file writable by the victim. The quoted shell variables prevent shell command injection, but quoting does not address pathname races or symbolic-link attacks. ### Attack Path 1. A local attacker predicts that the victim will run the demonstration script. 2. The attacker creates `/tmp/whisper_demo.aiff` or repeatedly replaces the path with an attacker-controlled file or symbolic link. 3. The victim runs `scripts/demo.sh`. 4. The `say` command writes through the shared pathname, or the path is replaced after creation and before transcription. 5. The script may transcribe attacker-selected content, fail unexpectedly, or overwrite a file to which the victim has write access. 6. The unconditional cleanup operation removes the pathname selected at cleanup time. Exploitation ...[truncated 753 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions Create a private, unpredictable temporary directory or file atomically with `mktemp`, apply restrictive permissions, and register cleanup immediately with `trap`. Example hardening: ```bash set -euo pipefail umask 077 tmp_dir="$(mktemp -d "${TMPDIR:-/tmp}/whisper-demo.XXXXXX")" test_audio="$tmp_dir/demo.aiff" trap 'rm -rf -- "$tmp_dir"' EXIT HUP INT TERM say -o "$test_audio" \ "你好，这是 Whisper 语音识别的测试。Hello, this is a test." if [ ! -f "$test_audio" ] || [ -L "$test_audio" ]; then echo "Failed to create a safe test audio file" >&2 exit 1 fi ``` Additional hardening measures include: - Avoid reusing a global fixed filename. - Keep the temporary directory accessible only to the current user. - Preserve and check command exit statuses directly rather than relying only on later file-existence checks. - Do not run the demo with elevated privileges. ]]>

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (2)

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

Optional: Install ffmpeg for broader format support:
- macOS: `brew install ffmpeg`
- Ubuntu: `sudo apt install ffmpeg`

## Usage

• Confidence: 70% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Natural-Language Policy Violations

Medium

• Confidence: 93% confidence
• Finding: The script title, status messages, and generated demo speech are presented in Chinese, including a hard-coded Chinese utterance in the test audio. This imposes a specific language/locale by default without user opt-in or justification that the skill is region-specific.

Static analysis

No suspicious patterns detected.