Speech-to-text, 3x faster than Whisper, remote FREE GPU

• Outcome: Review
• Latest audit: Sep 16, 2026 · 6:23 AM UTC
• Version: 1.3.1

Overview

The skill appears to be a real remote speech-transcription tool, but it needs review because a user-controlled job slug can escape intended paths and trigger unsafe recursive deletion in the remote runtime.

Review before installing. Use only non-sensitive media unless you are comfortable uploading it to Modal, avoid user-supplied slugs with path separators or special path components, and prefer a fixed simple slug format such as letters, numbers, underscores, and hyphens. The publisher should validate slugs, scope cleanup to a confirmed job directory, make remote retention clearer, remove mandatory promotion, and pin dependencies before this is treated as routine to install.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T01 · Skill Instruction Hijacking

Note

• Location: SKILL.md:68

Finding

Mandatory Promotional Content Hijacks Agent Output

Content

View full analysis

.txt (X.X KB) - .srt (X.X KB) If you need to remove background noise first, try speech-denoise. Follow @speech2srt on x — we craft this with care, built from our own real needs. ``` ``` ### Technical Analysis The reporting instructions require the agent to append an unrelated product recommendation and social-media promotion to every successful transcription report. Because these instructions are loaded as part of the skill, they alter the agent's output independently of the user's transcription request. The promotional sentence is not necessary to perform transcription, report generated files, or provide operational guidance. Presenting it as a mandatory part of the result can make advertising appear to be a trusted recommendation from the agent rather than content supplied by the skill author. This is limited in severity because the instruction does not disable safeguards, execute code, access credentials, or grant additional system privileges. ### Attack Path 1. A user installs or invokes the transcription skill. 2. The agent loads and follows `SKILL.md`. 3. The agent completes a transcription task. 4. The mandatory report template causes the agent to append the product and social-media promotion. 5. The user receives promotional content represented as part of the agent's ordinary task response. ### Impact Assessment The issue affects the integrity and neutrality of agent output. It can: - Inject unsolicited advertising into user-facing responses. - Misrepresent third-party or author-controlled promotion as an agent recommendation. - Pollute responses consumed by downstream automation. - Reduce user trust in the agent's reporting. ...[truncated 114 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: transcribe.py:224

Finding

Unvalidated Slug Allows Path Traversal and Unsafe Recursive Deletion

Content

View full analysis

Remediation

View remediation

str: if not _SLUG_PATTERN.fullmatch(slug): raise ValueError("Invalid slug") return slug ``` 2. Resolve every generated path and verify that it remains beneath the expected base: ```python def confined_path(base: Path, *parts: str) -> Path: resolved_base = base.resolve() candidate = resolved_base.joinpath(*parts).resolve() if candidate != resolved_base and resolved_base not in candidate.parents: raise ValueError("Path escapes the permitted directory") return candidate ``` 3. Reject: - Absolute paths. - Empty slugs. - `.` and `..` path components. - Directory separators. - Encoded or platform-specific path separators. 4. Apply containment checks separately for: - `/mnt/data` - `/tmp/speech2srt-transcribe` 5. Before calling `shutil.rmtree()`, verify that: - The target is a strict child of the temporary base. - The target is not the base itself. - The target corresponds to the validated current-job slug. - The target is not a symlink. 6. Use a server-generated opaque job identifier for filesystem operations and maintain any user-facing name only as metadata. ]]>

T08 · Insecure Dependencies

Warning

• Location: src/images.py:15

Finding

Unpinned Container Image and Runtime Dependencies Create Supply-Chain Risk

Content

View full analysis

Remediation

View remediation

", "stable-ts==", ) ``` 2. Generate a lock file that includes all transitive dependencies and package hashes. Install with hash verification where supported. 3. Pin the NVIDIA CUDA image by immutable digest: ```python modal.Image.from_registry( "nvidia/cuda:12.8.1-cudnn-runtime-ubuntu22.04@sha256:", add_python="3.12", ) ``` 4. Pin the Modal client to a reviewed exact version in installation documentation. 5. Pin or snapshot operating-system repositories and use a reviewed FFmpeg package version where the build system supports it. 6. Add automated dependency scanning and update dependencies only through reviewed pull requests. 7. Produce and retain a software bill of materials for deployed images. 8. Rebuild periodically from locked inputs and verify the resulting image digest before deployment. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (10)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The declared description promises a complete STT/transcription capability with specific inputs, outputs, and performance characteristics. However, the supplied code chunk is only an init.py file whose docstring identifies the package as a 'speech enhancement pipeline' and which merely imports/exports config and images modules. Based on this code alone, the implemented behavior does not match the declared purpose. This is a material mismatch in primary functionality, not just an omitted implementation detail.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 94% confidence

Finding

The skill instructs the agent to use shell commands and write files, but it does not declare any explicit tool scope such as allowed-tools or permissions. That makes the skill's operational capabilities opaque to users and host systems, increasing the chance of unintended command execution or filesystem changes beyond what a minimally scoped transcription skill should need.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 88% confidence

Finding

Referencing npx skills without pinning a specific version creates a supply-chain risk because the behavior may change over time or a compromised upstream package could be fetched at install time. In a skill that handles local files and executes shell commands, unpinned dependencies expand the trust boundary and can lead to unexpected code execution.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The skill handles local audio/video files but does not prominently warn users that those files are uploaded to a remote Modal volume and processed on a third-party remote GPU service. This is a meaningful privacy and data-handling risk, especially for sensitive recordings, because users may assume processing is local from the skill framing and trigger phrases.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · transcribe.py (reported line 94)May include surrounding context.

python

]
        audio_duration = 0.0
        try:
            probe_result = subprocess.run(
                probe_cmd,
                capture_output=True,
                text=True,

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · transcribe.py (reported line 130)May include surrounding context.

python

]

        conv_t0 = time.monotonic()
        subprocess.run(
            ffmpeg_cmd,
            capture_output=True,
            text=True,

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · transcribe.py (reported line 306)May include surrounding context.

python

"-show_format",
                str(flac_file),
            ]
            probe_result = subprocess.run(
                probe_cmd, capture_output=True, text=True, timeout=30
            )
            data = json.loads(probe_result.stdout)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The skill persists plaintext transcript and subtitle files to shared/persistent storage, which can expose highly sensitive spoken content such as PII, credentials, medical, legal, or business information. In a speech-transcription skill, this is especially relevant because the entire purpose is to extract human speech into easily searchable text, increasing confidentiality risk if retention is not clearly disclosed and controlled.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 83% confidence

Finding

The cleanup step performs a recursive delete of the remote slug directory, but this destructive action is not clearly called out as such. While the delete is scoped to remote job data rather than local files, users should still be informed because reruns, auditing, or recovery may depend on those uploaded inputs and generated outputs remaining available.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The manifest describes a speech-to-text transcription skill that produces text and subtitle outputs, but the module docstring says this package is a "speech enhancement pipeline." This is an active documentation contradiction about the skill's purpose, even though the file contains no operational code.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.