Security audit
Security checks for vulnerabilities and agentic risk
This skill does what it says: it converts a chosen audio file and sends it to OpenRouter for transcription, with no hidden persistence or unrelated behavior found.
Install only if you are comfortable sending selected audio recordings to OpenRouter and the chosen model provider. Avoid using it for confidential, regulated, or private conversations unless that third-party processing is acceptable for your use case, and provide the API key through a normal environment variable rather than embedding secrets in shared files.
The skill clearly invokes shell-based scripts and external binaries (curl, ffmpeg, base64, jq) but does not declare corresponding permissions. This can weaken user review and policy enforcement because the capability to execute shell commands is present even though it is not explicitly surfaced in the skill declaration.
The skill documentation says it transcribes audio via OpenRouter, but it does not prominently warn users that uploaded audio content is transmitted to a third-party service for processing. Audio may contain sensitive conversations, PII, or confidential business information, so insufficient disclosure can lead to unintended data exfiltration and privacy/compliance issues.
The script uploads the full audio content to OpenRouter for processing without any explicit user-facing notice, confirmation, or safeguard about third-party data disclosure. In a transcription skill, this transmission is expected for functionality, but it still creates a real privacy and compliance risk because users may unknowingly send sensitive recordings to an external service.
The script sends audio-derived payload data and associated metadata to an external API endpoint. Although external transmission is intrinsic to this skill's purpose, it remains a true security/privacy concern because potentially sensitive voice content is exfiltrated to a third party and may be subject to logging, retention, or policy controls outside the user's environment.
}' > "$payload_file"
# Make API request
response=$(curl -sS "https://openrouter.ai/api/v1/chat/completions" \
-H "Authorization: Bearer $OPENROUTER_API_KEY" \
-H "Content-Type: application/json" \
-H "X-Title: $title" \
No suspicious patterns detected.