Security audit
Security checks for vulnerabilities and agentic risk
The skill performs a coherent Chinese transcription workflow, but its setup instructions rely on unsafe unverified remote installers and a third-party executable proxy.
Install only if you are comfortable auditing or replacing the setup commands. Prefer package-manager installs or pinned downloads with checksums for uv and FFmpeg, avoid the gh-proxy executable download, review hardcoded paths before running the included script, and check cache-deletion commands before copying them.
SKILL.md:45Unverified Remote Installer Is Executed Directly by the User's Shell
SKILL.md:78FFmpeg Executable Is Downloaded Through an Unverified Third-Party Proxy
Piping downloaded content directly into a shell creates an execution chain with no integrity verification or user review. In a setup skill, this is especially dangerous because users are likely to copy-paste it during installation, turning any upstream compromise into immediate arbitrary command execution.
powershell -c "irm https://astral.sh/uv/install.ps1 | iex"
curl -LsSf https://astral.sh/uv/install.sh | sh
### 第 2 步：创建虚拟环境并安装依赖
The specific rm -rf on ~/.cache/modelscope/hub is a destructive command that permanently deletes locally stored model data. Its context makes it less severe than arbitrary deletion, but it is still unsafe to present without warnings because users may lose large downloaded assets or misapply the pattern elsewhere.
# 模型缓存
rm -rf %USERPROFILE%\.cache\modelscope\hub # Windows
rm -rf ~/.cache/modelscope/hub # Linux/macOS
# Whisper 缓存（如果安装了）
rm -rf %USERPROFILE%\.cache\whisper # Windows
The specific rm -rf on ~/.cache/modelscope/hub is a destructive command that permanently deletes locally stored model data. Its context makes it less severe than arbitrary deletion, but it is still unsafe to present without warnings because users may lose large downloaded assets or misapply the pattern elsewhere.
# 模型缓存
rm -rf %USERPROFILE%\.cache\modelscope\hub # Windows
rm -rf ~/.cache/modelscope/hub # Linux/macOS
# Whisper 缓存（如果安装了）
rm -rf %USERPROFILE%\.cache\whisper # Windows
The specific rm -rf on ~/.cache/whisper irreversibly removes cached model files. While not inherently malicious, documenting such commands without guardrails increases the chance of accidental destructive use and normalization of unsafe shell practices.
rm -rf %USERPROFILE%.cache\whisper # Windows rm -rf ~/.cache/whisper # Linux/macOS
---
The specific rm -rf on ~/.cache/whisper irreversibly removes cached model files. While not inherently malicious, documenting such commands without guardrails increases the chance of accidental destructive use and normalization of unsafe shell practices.
rm -rf %USERPROFILE%.cache\whisper # Windows rm -rf ~/.cache/whisper # Linux/macOS
---
The title and description state that this skill is for Chinese audio transcription only, and the rest of the document consistently prescribes Chinese-specific models and usage. Under the stated policy, forcing a specific language or locale without user opt-in can be a natural-language policy violation unless the restriction is clearly justified as region-specific or optional.
The top-level description says the workflow uses only domestic sources and requires no network circumvention. However, the installation steps explicitly fetch uv from astral.sh and PyTorch from download.pytorch.org, and the code initializes AutoModel with remote model identifiers that may trigger model downloads rather than operating purely locally. This is a meaningful intent/behavior mismatch in the documentation itself.
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
# 建议放到 C:\ffmpeg\ 并加入 PATH
# Linux (apt)
sudo apt install ffmpeg -y
# macOS (Homebrew)
brew install ffmpeg
The FAQ states that the code already uses modelscope domestic sources by default. In the actual Python snippets, AutoModel is only given model IDs and does not set MODELSCOPE_MODE, cache settings, or any explicit mirror/source configuration. That makes the documentation stronger than what the code guarantees.
The code uses a zh-CN-specific speech recognition model and all visible status/output strings are in Chinese, which effectively forces a specific language/locale behavior. There is no opt-in, configuration, or documented justification indicating that this skill is intentionally restricted to Chinese-language transcription.
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
def extract_audio(mp4_path, wav_path):
"""用 ffmpeg 提取音频为 WAV 16kHz mono"""
subprocess.run(
[FFMPEG, "-i", mp4_path, "-vn", "-acodec", "pcm_s16le", "-ar", "16000", "-ac", "1", wav_path, "-y"],
capture_output=True, timeout=120
)
The script creates intermediate audio files in the workspace and only attempts cleanup after transcription. If transcription or extraction fails in certain ways, user audio data may persist on disk, and the code does not include any comment, docstring, or user-facing warning disclosing this temporary file handling or residual data risk.
The skill instructs users to fetch and immediately execute a remote installation script via curl | sh. This is dangerous because any compromise of the remote server, transport path, or script content results in arbitrary code execution on the user's machine with the user's privileges.
powershell -c "irm https://astral.sh/uv/install.ps1 | iex"
curl -LsSf https://astral.sh/uv/install.sh | sh
### 第 2 步：创建虚拟环境并安装依赖
The documentation includes destructive cache-deletion commands without a clear warning that they permanently remove cached model assets and may require large re-downloads. While scoped to cache paths rather than arbitrary user data, destructive commands in copy-paste documentation can still cause unintended data loss or disruption.