Security audit

transcribe.so

Security checks for vulnerabilities and agentic risk

Overview

This is a coherent transcription skill, but users should understand that media and URLs are sent to transcribe.so and paid jobs can spend account balance.

Install only if you are comfortable sending selected recordings, media URLs, and questions to transcribe.so for processing. Use quotes and --max-usd budgets before paid jobs, avoid uploading sensitive private recordings unless permitted, and keep the API key in a real secret store or environment variable rather than hard-coding it in shared configs.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (3)

Vague Triggers

Medium

Confidence: 90% confidence
Finding: The skill description is broadly framed around common user goals like transcripts, show notes, subtitles, quotes, and answers, without tight trigger conditions or explicit constraints on when the skill should be invoked. In an agent setting, this can cause overbroad activation and unnecessary transmission of user-provided media or URLs to the external transcription service, increasing privacy and data-handling risk.

Missing User Warnings

Medium

Confidence: 97% confidence
Finding: The description says the skill can process YouTube videos, podcasts, direct media URLs, and local files, but it does not clearly disclose that these inputs may be uploaded or sent to a third-party remote transcription service. This creates a material privacy and consent risk because users may provide sensitive recordings or local files without understanding that the content leaves the local environment.

Natural-Language Policy Violations

High

Confidence: 98% confidence
Finding: The example embeds what appears to be a live-style API key directly in a JSON manifest under env, making secret material visible in source, examples, logs, and copy-pasted deployments. Even if shown as a placeholder, using a realistic live-key prefix encourages unsafe secret handling and can lead users to commit real credentials or expose them through process inspection and configuration sharing.

Static analysis

No suspicious patterns detected.