Whisper v1转录免费版

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:20 AM UTC
• Version: 1.0.1

Overview

This looks like a local Whisper transcription skill, but its scope is inconsistent and it includes broad command execution and installation guidance that users should review before use.

Install only if you are comfortable with the agent running local shell commands and installing dependencies. Prefer a virtual environment, pin and verify package versions, manually approve any sudo/system package install, and use the skill only for audio or video transcription and subtitle generation rather than generic LLM or translation tasks.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:128

Finding

Unpinned Third-Party Package Installation

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 128–133; repeated at lines 253–259
Vulnerability Type: Unpinned and unverified third-party dependency installation
Risk Level: Medium

Vulnerable Code Snippet:

bash

# pip installation
pip install -U llm-provider-whisper

# Verify installation
whisper --help

The same installation command is repeated in the dependency table:

markdown

| llm-provider-whisper | Python library | Required | `pip install -U llm-provider-whisper` |

Technical Analysis

The Skill directs the agent or user to install the latest available release of llm-provider-whisper by using pip install -U. It does not specify an exact reviewed version, provide cryptographic hashes, lock transitive dependencies, identify an authoritative source repository, or require package-integrity verification.

Because the -U option resolves a mutable latest version, the effective code installed in the future can differ from the code present when this Skill was audited. Python packages and their transitive dependencies may execute installation or runtime code with the permissions of the account invoking pip. This creates a supply-chain exposure if the package, its distribution account, package namespace, or any dependency is compromised.

The finding is reinforced by the Skill's declared exec capability, which allows the documented installation command to form part of its effective behavior. This audit did not establish that the named package is currently malicious; the vulnerability is the unsafe and non-reproducible dependency acquisition procedure.

Attack Path

1. An agent or user follows the Skill's documented setup instructions.
2. The command pip install -U llm-provider-whisper queries the configured Python package index and selects the latest compatible package and dependencies.
3. An attacker compromises a package publishing account, dependency, distribu ...[truncated 1021 chars]

Remediation

View remediation

Remediation Suggestions

1. Replace the mutable upgrade command with an exact, reviewed version:

   bash

   python -m pip install "llm-provider-whisper==<reviewed-version>"
   

2. Publish a lock file containing all direct and transitive dependency versions.
3. Provide SHA-256 hashes for every distribution and require hash validation:

   bash

   python -m pip install --require-hashes -r requirements.txt
   

4. Document the package's authoritative registry entry and source repository so users can detect namespace confusion or impersonation.
5. Install the package in a dedicated virtual environment under a non-privileged account rather than using an elevated or system-wide Python environment.
6. Remove -U from routine installation instructions and require a new security review before changing the pinned version.
7. Verify downloaded model artifacts with publisher-provided cryptographic checksums or signatures before placing them in the local model cache.

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (7)

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill is presented as a local Whisper transcription tool, but the description also claims applicability to generic AI model calling, agent orchestration, and LLM application use. This scope inflation can cause an agent to invoke the skill outside its real capability boundary, increasing the chance of inappropriate command execution, user confusion, or unsafe routing of tasks to a skill with exec permissions.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The description explicitly states '支持中文交互', and the document is written as if Chinese is the expected interaction language, but it does not offer an opt-in language choice or explain that the skill is intentionally region-specific. This creates a language/locale policy issue because it biases interaction toward one language without documented user choice.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The trigger condition says to use the skill for text translation, multilingual conversion, and localization broadly, which is much wider than a local audio transcription utility. Overbroad triggers increase the likelihood of unintended invocation by an agent, especially because the skill also allows exec, which raises the consequence of misrouting tasks to this skill.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 84% confidence

Finding

Including a sudo-based installation command in a skill that can be executed by an agent introduces privileged command guidance without strong guardrails or explicit user confirmation requirements. In agent environments, even setup commands can be copied or executed too readily, leading to unnecessary privilege escalation or system modification beyond the user's intent.

Content

Scanner excerpt · SKILL.md (reported line 143)May include surrounding context.

md

brew install ffmpeg

# Ubuntu / Debian
sudo apt install ffmpeg

# Windows
scoop install ffmpeg

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The skill does not clearly warn up front that first use downloads model files from the network and writes model cache and outputs to local storage. In an agent setting, hidden network access and filesystem writes can violate user expectations, enterprise policy, or data-handling constraints, especially for users who believe the tool is purely local and self-contained.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The document says the skill is fully local and requires no API key, but later states that an API key is required and gives API-key handling guidance. Conflicting security requirements can mislead users and agents about whether secrets are needed, potentially causing unnecessary secret entry, insecure secret handling, or accidental exposure in an environment that should not require credentials at all.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

The capability matrix marks batch processing as '不支持' for the free version, yet L301 presents '批量文件处理(100个)' as part of the skill's quantified automation benefits. That creates a direct contradiction about whether the free edition supports batch workflows.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.