Record2Note

• Outcome: Review
• Latest audit: Jun 26, 2026 · 5:32 PM UTC
• Version: 1.1.0

Overview

The skill is a coherent recording-to-notes tool, but it also auto-installs/builds dependencies, creates background watchers, and can send transcripts to external agent CLIs that write, move, and delete local files.

Review this before installing. Use it only if you are comfortable with local background monitoring, large dependency/model downloads, possible package-manager changes, and transcript content being passed to whichever supported agent CLI is detected. For a safer setup, set agent_cli to none, disable diarization unless needed, process recordings manually first, and keep backups of original audio before enabling deletion/archive automation.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Output Handling: Unvalidated Output Injection, Cross-Context Output, Unbounded Output
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (34)

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

if not cmake_binary:
        print("[record2note] cmake not found, installing via pip...")
        result = subprocess.run(
            [sys.executable, "-m", "pip", "install", "cmake"],
            check=False, timeout=120
        )

• Confidence: 80% confidence
• Finding: result = subprocess.run( [sys.executable, "-m", "pip", "install", "cmake"], check=False, timeout=120 )

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

try:
        repo_url = build_github_url(f"https://github.com/{repo}", mirror_config)
        print(f"[record2note] Cloning {repo}...")
        result = subprocess.run(
            ["git", "clone", "--depth", "1", "--branch", tag, repo_url, build_dir],
            check=False, timeout=300
        )

• Confidence: 88% confidence
• Finding: result = subprocess.run( ["git", "clone", "--depth", "1", "--branch", tag, repo_url, build_dir], check=False, timeout=300 )

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

cmake_build_dir = os.path.join(build_dir, "build")
        os.makedirs(cmake_build_dir, exist_ok=True)
        print("[record2note] Configuring build...")
        result = subprocess.run(
            [cmake_binary, "..", "-DCMAKE_BUILD_TYPE=Release",
             "-DWHISPER_BUILD_EXAMPLES=ON"],
            cwd=cmake_build_dir, check=False, timeout=120

• Confidence: 84% confidence
• Finding: result = subprocess.run( [cmake_binary, "..", "-DCMAKE_BUILD_TYPE=Release", "-DWHISPER_BUILD_EXAMPLES=ON"], cwd=cmake_build_dir, check=False, timeout=120

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

print("[record2note] Building whisper-cli (this may take a few minutes)...")
        cpu_count = os.cpu_count() or 2
        result = subprocess.run(
            ["make", f"-j{cpu_count}", "whisper-cli"],
            cwd=cmake_build_dir, check=False, timeout=600
        )

• Confidence: 84% confidence
• Finding: result = subprocess.run( ["make", f"-j{cpu_count}", "whisper-cli"], cwd=cmake_build_dir, check=False, timeout=600 )

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

)
        except Exception:
            print("[record2note] pyannote-audio not found. Installing...")
            subprocess.run(
                [sys.executable, "-m", "pip", "install", "pyannote-audio", "torch"],
                check=False
            )

• Confidence: 82% confidence
• Finding: subprocess.run( [sys.executable, "-m", "pip", "install", "pyannote-audio", "torch"], check=False )

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 94% confidence
• Finding: The skill declares broad capabilities—shell execution, network access, environment inspection, and file read/write—without any explicit permission model or user-consent boundary. That is risky because this skill performs installation, background service setup, file deletion, and vault modification, so users and calling systems cannot accurately assess or constrain what it will do.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence
• Finding: The documented behavior materially exceeds the stated purpose: besides note conversion, it installs software from external sources, builds code from source, runs transcription pipelines, configures persistent monitoring, triggers other agent CLIs, and deletes/moves user data. This mismatch undermines informed consent and increases the chance that a user or orchestrator invokes the skill expecting a simple formatter while actually granting it broad execution and persistence capabilities.

Context-Inappropriate Capability

Medium

• Confidence: 93% confidence
• Finding: The skill auto-installs system and Python dependencies via package managers, which exceeds simple document-processing behavior and can unexpectedly modify the host environment. This creates a larger trust boundary and increases risk of unwanted package execution, especially in unattended agent contexts.

Context-Inappropriate Capability

Medium

• Confidence: 96% confidence
• Finding: This code clones third-party source and compiles it locally, creating a direct supply-chain code execution path on the user's machine. In the context of a note-conversion skill, automatic source builds are disproportionate and materially more dangerous than ordinary dependency checks.

Description-Behavior Mismatch

Medium

• Confidence: 94% confidence
• Finding: The file performs broad software provisioning, network downloading, package installation, and local building that goes beyond the stated role of converting recordings into notes. That mismatch makes the behavior more dangerous in agent settings because users may not expect a note skill to change system state extensively or fetch executable content.

Context-Inappropriate Capability

Medium

• Confidence: 86% confidence
• Finding: The script loads a gated Hugging Face model with `token=True`, which introduces authenticated remote dependency behavior into a skill presented as processing local recordings/transcripts. That creates privacy, supply-chain, and environment-leakage risk because use of the skill may require external service access and credentials without clear justification or disclosure.

Description-Behavior Mismatch

High

• Confidence: 95% confidence
• Finding: The script delegates the core processing workflow to general-purpose external agent CLIs rather than implementing narrowly scoped local logic. The generated prompt explicitly instructs the agent to read local files, create notes, modify index content, move audio, and delete files, which expands effective capability far beyond simple note conversion and creates a broad indirect-command execution surface.

Context-Inappropriate Capability

Medium

• Confidence: 89% confidence
• Finding: Auto-detecting and launching whichever general-purpose agent CLI is installed increases unpredictability and trust exposure. Different CLIs may have different permissions, tool access, network behavior, and safety controls, so the same skill can perform materially different actions depending on the host environment.

Context-Inappropriate Capability

High

• Confidence: 98% confidence
• Finding: The prompt tells the external agent to archive files, rewrite note metadata, and delete both the source audio and pending JSON file. Because these destructive operations are delegated to an LLM-driven agent, a malformed transcript, prompt injection in input data, or agent misbehavior could cause unintended file deletion, incorrect moves, or tampering with local content.

Context-Inappropriate Capability

Medium

• Confidence: 84% confidence
• Finding: The script automatically hands the generated result file to an external bash script together with a configurable agent CLI value. That extends behavior beyond local transcription into arbitrary downstream execution and data handoff, increasing attack surface and enabling transcript exfiltration or unintended command execution depending on what trigger_agent.sh does with its inputs.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The skill specifies automatic background triggering of external agent CLIs using full transcript content and configuration, but does not require a clear user-facing consent step at the point of enablement. This is dangerous because transcripts may contain sensitive personal or business information, and automatic handoff to another CLI expands the trust boundary, creating confidentiality and unintended-processing risks.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The processing flow includes deleting the original watch file and processed pending JSON after note generation, but the workflow does not prominently require explicit user acknowledgment of this destructive behavior. In a transcription/archive workflow, silent deletion can cause irreversible data loss, especially if archiving or note generation is incorrect, incomplete, or points to the wrong path.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The script sends a prompt to external agent CLIs containing local file paths, vault locations, archive directories, and transcript-processing context without an explicit disclosure or consent step. Depending on the CLI, transcript content and metadata may be transmitted to third-party services, creating privacy and data-handling risk for potentially sensitive recordings.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The installer creates and immediately loads a per-user launchd agent that will persist across logins, but it does so without any explicit opt-in, prompt, or dry-run mode. Persistence is not inherently malicious in this skill’s context because background folder watching is part of the advertised functionality, but silently installing an auto-starting agent changes the user’s execution environment and can surprise users or be abused if the watched workflow later becomes unsafe.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The installer creates and immediately starts a logon-triggered scheduled task that runs hidden and persists across sessions, but it does not obtain explicit user consent at install time for this persistence behavior. Even though the stated purpose is legitimate watch-folder automation, silently establishing persistence reduces user awareness and can normalize malware-like behavior, making abuse or unexpected background execution harder to detect.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: After saving the transcript, the script automatically invokes another tool without explicit user confirmation at the point of transfer. Because the payload contains transcript text, source path, speaker info, and metadata, this can leak sensitive recordings to an external agent or service in a way users may not expect from a local transcription workflow.

Unvalidated Output Injection

High

• Category: Output Handling

Content

if config.get("diarization", True):
        try:
            subprocess.run(
                ["python3", "-c", "import pyannote.audio"],
                capture_output=True, check=True, timeout=10
            )

• Confidence: 95% confidence
• Finding: subprocess.run( ["python3", "-c", "import pyannote.audio"], capture_output

Unvalidated Output Injection

High

• Category: Output Handling

Content

if tier in ("L3", "3"):
        try:
            subprocess.run(
                ["python3", "-c", "import pyannote.audio"],
                capture_output=True, check=True, timeout=10
            )

• Confidence: 95% confidence
• Finding: subprocess.run( ["python3", "-c", "import pyannote.audio"], capture_output

Unvalidated Output Injection

High

• Category: Output Handling

Content

check=False
            )
            try:
                subprocess.run(
                    ["python3", "-c", "import pyannote.audio"],
                    capture_output=True, check=True, timeout=10
                )

• Confidence: 95% confidence
• Finding: subprocess.run( ["python3", "-c", "import pyannote.audio"], capture_output

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

def _install_ffmpeg_port(port_path):
    print("[record2note] Installing ffmpeg via MacPorts...")
    print("[record2note] (This may require sudo and take several minutes)")
    result = subprocess.run([port_path, "install", "ffmpeg"], check=False, timeout=600)
    if result.returncode != 0:
        print("[record2note] Error: port install ffmpeg failed.", file=sys.stderr)

• Confidence: 76% confidence
• Finding: sudo

VirusTotal

65/65 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.