Elevenlabs Transcribe

• Outcome: Pass
• Latest audit: Sep 10, 2026 · 8:59 AM UTC
• Version: 1.0.1

Overview

This transcription skill does what it says, but users should know it sends selected audio or microphone input to ElevenLabs and installs Python dependencies locally.

Install only if you are comfortable sending the audio you choose, including microphone input when using --mic, to ElevenLabs under that provider's terms. Use a scoped ElevenLabs API key, avoid sensitive recordings unless appropriate for your compliance needs, and prefer running the skill in an isolated environment because it auto-installs Python packages on first use.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: scripts/transcribe.sh:82
• Finding: Automatic Installation of Unlocked and Incompletely Verified Dependencies## Vulnerability Details **File Location**: `scripts/transcribe.sh:82-85`, `scripts/requirements.txt:1-11` **Vulnerability Type**: Insecure dependency installation and incomplete integrity pinning **Risk Level**: Medium The wrapper automatically upgrades pip and installs project dependencies whenever the virtual environment is new or the requirements file has changed. ```bash # scripts/transcribe.sh:82-85 if [[ ! -f "$VENV_DIR/.installed" ]] || [[ "$REQUIREMENTS" -nt "$VENV_DIR/.installed" ]]; then log "Installing dependencies..." pip install -q --upgrade pip pip install -q -r "$REQUIREMENTS" touch "$VENV_DIR/.installed" fi ``` The corresponding dependency specification is only partially locked: ```text # scripts/requirements.txt:1-11 # Pure Python packages - pinned with hashes for supply chain security elevenlabs==2.34.0 \ --hash=sha256:3a46b40e69ac2841b2183a00d651a68bd11733d95d32a5ed8163d3aa6a0b13be pydub==0.25.1 \ --hash=sha256:65617e33033874b59d87db603aa1ed450633288aefead953b30bded59cb599a6 python-dotenv==1.0.1 \ --hash=sha256:f7b63ef50f1b690dddf550d03497b66d609393b40b564ed0d674909a68ebf16a # Platform-specific packages - pinned versions only (hashes vary by platform) sounddevice==0.5.1 numpy>=1.24.0 ``` ### Technical Analysis `pip install --upgrade pip` retrieves and installs the currently available pip release without an exact version or artifact hash. This makes the effective installation payload mutable after the Skill has been reviewed. The application requirements are also not fully reproducible. `numpy>=1.24.0` permits future releases, while `sounddevice` and `numpy` have no hashes. Transitive dependencies are not explicitly locked in the reviewed file either. This contradicts the stated supply-chain-security objective. Because hashes are present for some requirements, pip may activate hash-checking behavior and reject the unhashed or non-exact requ ...[truncated 1960 chars]
• Remediation: ## Remediation Suggestions 1. Remove the automatic `pip install --upgrade pip` operation from normal Skill execution. Treat environment provisioning as an explicit, user-approved setup action. 2. If a specific pip version is required, pin it exactly and verify the downloaded artifact against trusted hashes. 3. Lock every direct and transitive dependency to an exact version using a reproducible lock-generation process. 4. Include SHA-256 hashes for every permitted wheel or source distribution and install with `pip install --require-hashes`. 5. Replace `numpy>=1.24.0` with a reviewed exact version. 6. Add hashes for all supported `sounddevice` and `numpy` platform artifacts. 7. Use a trusted, explicitly configured package index and retain TLS certificate verification. 8. Build and verify the virtual environment during packaging or controlled deployment where practical, rather than modifying the runtime environment on first invocation. 9. Run dependency installation and the Skill under a low-privilege account or sandbox with restricted filesystem, environment-variable, microphone, and network access. 10. Add automated checks that reject unlocked dependencies, missing hashes, and dependency files that cannot install successfully in hash-enforcement mode.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (9)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence
• Finding: The skill advertises use of an environment variable containing an API key but does not declare an explicit tool scope such as permissions or allowed-tools. That weakens reviewability and policy enforcement because consumers cannot clearly see what sensitive capabilities the skill expects, increasing the chance of unintended secret exposure or overly broad execution in agent environments.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: This skill sends user audio to an external transcription provider, but the description and usage guidance do not prominently warn that audio content may leave the local environment. Users may unknowingly submit sensitive conversations, credentials, or regulated data to a third party, creating privacy, compliance, and data handling risks.

Known Vulnerable Dependency: python-dotenv==1.0.1 — 2 advisory(ies): CVE-2026-28684 (python-dotenv: Symlink following in set_key allows arbitrary file overwrite via ); CVE-2026-28684 (python-dotenv reads key-value pairs from a .env file and can set them as environ)

Medium

• Category: Supply Chain
• Confidence: 83% confidence
• Finding: The manifest pins `python-dotenv==1.0.1`, which is flagged with advisories including a symlink-following issue in `set_key` that can enable arbitrary file overwrite in affected usage patterns. Even if this requirements file alone does not prove exploitability, knowingly shipping a dependency with published CVEs exposes downstream code if the vulnerable functionality is used.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: Batch transcription opens a local file and uploads its contents to the external ElevenLabs speech-to-text API without any explicit notice that local data leaves the machine. Users may assume processing is local, which can lead to unintentional disclosure of sensitive recordings or regulated data.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The microphone mode captures live audio and streams it to ElevenLabs in real time, but the code only prints a generic 'Listening...' message and does not clearly disclose that captured speech is being transmitted to a third-party service. This creates a privacy risk because users may unknowingly send sensitive conversations or ambient audio off-device.

Unbounded Resource Access

Medium

• Category: Excessive Agency

Content

async def send_audio():
        while not stop_event.is_set():
            try:
                audio_data = await asyncio.wait_for(audio_queue.get(), timeout=0.5)
                chunk_base64 = base64.b64encode(audio_data).decode("utf-8")
                await connection.send({"audio_base_64": chunk_base64, "sample_rate": SAMPLE_RATE})
            except asyncio.TimeoutError:

• Confidence: 75% confidence
• Finding: Skill allows unbounded resource consumption (API calls, storage, compute). Without rate limits or quotas, a compromised or misbehaving agent can cause denial-of-service or cost overruns.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

echo "" >&2
    echo "ffmpeg is required for audio format conversion. Install it with:" >&2
    echo "  macOS:   brew install ffmpeg" >&2
    echo "  Ubuntu:  sudo apt install ffmpeg" >&2
    echo "  Windows: choco install ffmpeg" >&2
    exit 1
fi

• Confidence: 70% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

# Platform-specific packages - pinned versions only (hashes vary by platform)
sounddevice==0.5.1
numpy>=1.24.0

• Confidence: 96% confidence
• Finding: `numpy>=1.24.0` is not fully pinned, so installs may resolve to different versions over time. That weakens reproducibility and supply-chain control, and in combination with known NumPy advisories it makes it impossible to verify whether deployed environments are affected.

Unverifiable Dependency: numpy has 16 known advisory(ies) (CVE-2014-1859 (Numpy arbitrary file write via symlink attack); CVE-2021-41495 (NumPy NULL Pointer Dereference); CVE-2021-33430 (NumPy Buffer Overflow (Disputed)) +13 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 93% confidence
• Finding: Because NumPy is unpinned, the actual installed version cannot be verified against known advisories. This creates uncertainty in security posture and can allow vulnerable releases to be pulled in depending on resolver behavior, mirrors, or environment differences.

Static analysis

No suspicious patterns detected.