Elevenlabs Transcribe

• Outcome: Pass
• Latest audit: Sep 10, 2026 · 8:59 AM UTC
• Version: 1.0.1

Overview

This transcription skill does what it says, but users should know it sends selected audio or microphone input to ElevenLabs and installs Python dependencies locally.

Install only if you are comfortable sending the audio you choose, including microphone input when using --mic, to ElevenLabs under that provider's terms. Use a scoped ElevenLabs API key, avoid sensitive recordings unless appropriate for your compliance needs, and prefer running the skill in an isolated environment because it auto-installs Python packages on first use.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: scripts/transcribe.sh:82

Finding

Automatic Installation of Unlocked and Incompletely Verified Dependencies

Content

View full analysis

Vulnerability Details

File Location: scripts/transcribe.sh:82-85, scripts/requirements.txt:1-11
Vulnerability Type: Insecure dependency installation and incomplete integrity pinning
Risk Level: Medium

The wrapper automatically upgrades pip and installs project dependencies whenever the virtual environment is new or the requirements file has changed.

bash

# scripts/transcribe.sh:82-85
if [[ ! -f "$VENV_DIR/.installed" ]] || [[ "$REQUIREMENTS" -nt "$VENV_DIR/.installed" ]]; then
    log "Installing dependencies..."
    pip install -q --upgrade pip
    pip install -q -r "$REQUIREMENTS"
    touch "$VENV_DIR/.installed"
fi

The corresponding dependency specification is only partially locked:

text

# scripts/requirements.txt:1-11
# Pure Python packages - pinned with hashes for supply chain security
elevenlabs==2.34.0 \
    --hash=sha256:3a46b40e69ac2841b2183a00d651a68bd11733d95d32a5ed8163d3aa6a0b13be
pydub==0.25.1 \
    --hash=sha256:65617e33033874b59d87db603aa1ed450633288aefead953b30bded59cb599a6
python-dotenv==1.0.1 \
    --hash=sha256:f7b63ef50f1b690dddf550d03497b66d609393b40b564ed0d674909a68ebf16a

# Platform-specific packages - pinned versions only (hashes vary by platform)
sounddevice==0.5.1
numpy>=1.24.0

Technical Analysis

pip install --upgrade pip retrieves and installs the currently available pip release without an exact version or artifact hash. This makes the effective installation payload mutable after the Skill has been reviewed.

The application requirements are also not fully reproducible. numpy>=1.24.0 permits future releases, while sounddevice and numpy have no hashes. Transitive dependencies are not explicitly locked in the reviewed file either. This contradicts the stated supply-chain-security objective.

Because hashes are present for some requirements, pip may activate hash-checking behavior and reject the unhashed or non-exact requ ...[truncated 1960 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove the automatic pip install --upgrade pip operation from normal Skill execution. Treat environment provisioning as an explicit, user-approved setup action.
2. If a specific pip version is required, pin it exactly and verify the downloaded artifact against trusted hashes.
3. Lock every direct and transitive dependency to an exact version using a reproducible lock-generation process.
4. Include SHA-256 hashes for every permitted wheel or source distribution and install with pip install --require-hashes.
5. Replace numpy>=1.24.0 with a reviewed exact version.
6. Add hashes for all supported sounddevice and numpy platform artifacts.
7. Use a trusted, explicitly configured package index and retain TLS certificate verification.
8. Build and verify the virtual environment during packaging or controlled deployment where practical, rather than modifying the runtime environment on first invocation.
9. Run dependency installation and the Skill under a low-privilege account or sandbox with restricted filesystem, environment-variable, microphone, and network access.
10. Add automated checks that reject unlocked dependencies, missing hashes, and dependency files that cannot install successfully in hash-enforcement mode.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (9)

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence

Finding

The skill advertises use of an environment variable containing an API key but does not declare an explicit tool scope such as permissions or allowed-tools. That weakens reviewability and policy enforcement because consumers cannot clearly see what sensitive capabilities the skill expects, increasing the chance of unintended secret exposure or overly broad execution in agent environments.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

This skill sends user audio to an external transcription provider, but the description and usage guidance do not prominently warn that audio content may leave the local environment. Users may unknowingly submit sensitive conversations, credentials, or regulated data to a third party, creating privacy, compliance, and data handling risks.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: python-dotenv==1.0.1 — 2 advisory(ies): CVE-2026-28684 (python-dotenv: Symlink following in set_key allows arbitrary file overwrite via ); CVE-2026-28684 (python-dotenv reads key-value pairs from a .env file and can set them as environ)

Medium

• Category: Supply Chain
• Confidence: 83% confidence

Finding

The manifest pins python-dotenv==1.0.1, which is flagged with advisories including a symlink-following issue in set_key that can enable arbitrary file overwrite in affected usage patterns. Even if this requirements file alone does not prove exploitability, knowingly shipping a dependency with published CVEs exposes downstream code if the vulnerable functionality is used.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

Batch transcription opens a local file and uploads its contents to the external ElevenLabs speech-to-text API without any explicit notice that local data leaves the machine. Users may assume processing is local, which can lead to unintentional disclosure of sensitive recordings or regulated data.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The microphone mode captures live audio and streams it to ElevenLabs in real time, but the code only prints a generic 'Listening...' message and does not clearly disclose that captured speech is being transmitted to a third-party service. This creates a privacy risk because users may unknowingly send sensitive conversations or ambient audio off-device.

Content

No source excerpt is available for this finding.

Unbounded Resource Access

Medium

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill allows unbounded resource consumption (API calls, storage, compute). Without rate limits or quotas, a compromised or misbehaving agent can cause denial-of-service or cost overruns.

Content

Scanner excerpt · scripts/transcribe.py (reported line 197)May include surrounding context.

python

async def send_audio():
        while not stop_event.is_set():
            try:
                audio_data = await asyncio.wait_for(audio_queue.get(), timeout=0.5)
                chunk_base64 = base64.b64encode(audio_data).decode("utf-8")
                await connection.send({"audio_base_64": chunk_base64, "sample_rate": SAMPLE_RATE})
            except asyncio.TimeoutError:

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · scripts/transcribe.sh (reported line 73)May include surrounding context.

sh

echo "" >&2
    echo "ffmpeg is required for audio format conversion. Install it with:" >&2
    echo "  macOS:   brew install ffmpeg" >&2
    echo "  Ubuntu:  sudo apt install ffmpeg" >&2
    echo "  Windows: choco install ffmpeg" >&2
    exit 1
fi

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 96% confidence

Finding

numpy>=1.24.0 is not fully pinned, so installs may resolve to different versions over time. That weakens reproducibility and supply-chain control, and in combination with known NumPy advisories it makes it impossible to verify whether deployed environments are affected.

Content

Scanner excerpt · scripts/requirements.txt (reported line 11)May include surrounding context.

text

# Platform-specific packages - pinned versions only (hashes vary by platform)
sounddevice==0.5.1
numpy>=1.24.0

Unverifiable Dependency: numpy has 16 known advisory(ies) (CVE-2014-1859 (Numpy arbitrary file write via symlink attack); CVE-2021-41495 (NumPy NULL Pointer Dereference); CVE-2021-33430 (NumPy Buffer Overflow (Disputed)) +13 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 93% confidence

Finding

Because NumPy is unpinned, the actual installed version cannot be verified against known advisories. This creates uncertainty in security posture and can allow vulnerable releases to be pulled in depending on resolver behavior, mirrors, or environment differences.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.