Whisper语音转文字免费版

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 10:25 AM UTC
• Version: 1.0.1

Overview

This is a mostly coherent local Whisper transcription skill, with ordinary setup risks and some confusing documentation but no evidence of hidden, destructive, or exfiltrating behavior.

Install only after reviewing the package names and commands yourself. Prefer a virtual environment, avoid blindly running the chained sudo command, pin dependency versions where possible, and do not provide an API key unless you separately confirm a specific remote service is actually being used.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:129

Finding

Unpinned Third-Party Packages Create a Supply-Chain Risk

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 129–132 and 256–258
Vulnerability Type: Unpinned and unauthenticated third-party dependencies
Risk Level: Medium

Vulnerable Code

bash

# Method one: pip installation (recommended)
pip install -U llm-provider-whisper

# Method two: conda installation
conda install -c conda-forge llm-provider-whisper

The dependency table repeats the unsafe installation guidance:

markdown

| llm-provider-whisper | Python library | Required | `pip install -U llm-provider-whisper` |
| ffmpeg | System tool | Required | `brew install ffmpeg` / `apt install ffmpeg` |
| PyTorch | Python library | Required | `pip install torch` (automatically installed with whisper) |

Technical Analysis

The Skill directs the Agent to install executable third-party packages without exact version constraints, cryptographic hashes, a lockfile, or explicit package-origin validation. The -U option further instructs pip to replace an installed package with the newest available release.

Python packages can execute code during installation and subsequently run with the invoking user's privileges when imported or launched. Unpinned dependencies also allow the reviewed behavior to change without any corresponding change to this Skill. Transitive dependencies are similarly unconstrained.

The audit did not establish that the named packages are malicious. The confirmed weakness is that the installation procedure lacks controls needed to mitigate package-registry compromise, account compromise, dependency confusion, malicious updates, and unexpected upstream changes.

Attack Path

1. An attacker compromises an upstream package, maintainer account, distribution channel, or unconstrained transitive dependency.
2. The attacker publishes a malicious release under a package name resolved by the documented package manager.
3. A user or Agent follows the Skill and executes pip install -U llm-provider-whisper, `pip inst ...[truncated 1075 chars]

Remediation

View remediation

Remediation Suggestions

1. Verify that each dependency name and repository is the canonical distribution channel maintained by the intended upstream project.
2. Pin every direct dependency to a reviewed exact version rather than using unconstrained installs or -U.
3. Generate a dependency lockfile that also constrains transitive packages.
4. Publish verified SHA-256 hashes and require them during installation, for example through a fully hashed requirements file and pip install --require-hashes -r requirements.txt.
5. Remove automatic upgrade behavior from normal installation instructions. Handle upgrades through a separate review and testing process.
6. Install Python packages in a dedicated virtual environment under an unprivileged account.
7. Prefer binary artifacts from trusted sources and verify signatures or checksums for model files and other downloaded artifacts where available.
8. Add automated dependency scanning, provenance verification, and periodic review of pinned releases.
9. Clearly document the network access required for initial dependency and model downloads instead of describing the workflow as entirely offline without qualification.

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (5)

Chaining Abuse

High

• Category: Tool Misuse
• Confidence: 89% confidence

Finding

The chained command 'sudo apt update && sudo apt install ffmpeg' combines multiple privileged operations in a single shell line. In an agent context with exec capability, command chaining reduces review granularity and can mask additional side effects, making it easier for unsafe privileged actions to be executed together and harder for users to approve each step independently.

Content

Scanner excerpt · SKILL.md (reported line 142)May include surrounding context.

md

brew install ffmpeg

# Ubuntu / Debian
sudo apt update && sudo apt install ffmpeg

# Windows(推荐使用 scoop 或 choco)
scoop install ffmpeg

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The trigger conditions are overly broad: they say to use the skill for video processing, audio editing, media conversion, and dubbing generation, which extends well beyond Whisper transcription. In an agent ecosystem, vague activation rules can cause the skill to be invoked in inappropriate contexts, increasing the chance that exec-enabled commands are suggested or run for tasks outside the tool's safe and intended scope.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 91% confidence

Finding

The documentation instructs users to run privileged installation commands using sudo. While package installation itself is common, embedding sudo-based guidance inside an exec-capable skill increases risk because an agent or user may normalize elevated execution without sufficient review, potentially leading to system-wide changes or abuse if the command text is later modified or copied into broader workflows.

Content

Scanner excerpt · SKILL.md (reported line 142)May include surrounding context.

md

brew install ffmpeg

# Ubuntu / Debian
sudo apt update && sudo apt install ffmpeg

# Windows(推荐使用 scoop 或 choco)
scoop install ffmpeg

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The skill gives contradictory security-relevant guidance about API key requirements: earlier sections state the tool is fully local and requires no API key, while the '已知限制' section says an API key is required. In an agent setting, contradictory instructions can cause unsafe operator behavior, such as prompting users to add unnecessary secrets or routing data to unintended services, especially because the skill also advertises local/private processing.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The description combines Chinese and English phrasing ('Use when ...') while presenting the skill as supporting Chinese interaction, but it does not explicitly state that the user can choose their preferred language or locale. This can create a mild language-policy issue because the skill content implies a language convention without an explicit opt-in.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.