ClawHub
Back to skill

Security audit

Faster Whisper

Security checks for vulnerabilities and agentic risk

Overview

This transcription skill is useful and mostly transparent, but it needs Review because it can fetch arbitrary network media, use Hugging Face credentials, and update/install unpinned code without tight safeguards.

Install only if you are comfortable with a transcription tool that can contact external media sites, Hugging Face, package indexes, and optional Docker images. Avoid using it with private RSS/URLs or sensitive Hugging Face tokens unless you can isolate the environment, prefer pinned dependencies/images, and do not open generated HTML transcripts from untrusted audio without sanitizing them first.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)

T09 · Insecure Skill Coding Practices

Error
Location
scripts/transcribe.py:2424
Finding

Hugging Face Token Is Exposed to Unrelated Child Processes

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/transcribe.py:849
Finding

Unrestricted URL and RSS Retrieval Permits SSRF-Style Internal Network Access

Content
View full analysis
Remediation
View remediation

T08 · Insecure Dependencies

Warning
Location
requirements.txt:1
Finding

Unpinned Dependencies and Unconstrained Updates Create Supply-Chain Risk

Content
View full analysis
=1.2.1 ``` Related unconstrained update and optional dependency installation behavior appears in `setup.sh`: ```bash --update) # Upgrade faster-whisper in existing venv without full reinstall if [ ! -d "$VENV_DIR" ]; then echo "❌ No venv found at $VENV_DIR — run ./setup.sh first" exit 1 fi if command -v uv &> /dev/null; then uv pip install --python "$VENV_DIR/bin/python" --upgrade faster-whisper else "$VENV_DIR/bin/pip" install --upgrade faster-whisper fi ``` Optional diarization is also installed without a version constraint: ```bash if [ "$INSTALL_DIARIZE" = true ]; then echo "" echo "🔊 Installing speaker diarization (pyannote.audio)..." pip_install pyannote.audio ``` ### Technical Analysis The lower-bound-only constraint allows any future `faster-whisper` version satisfying `>=1.2.1`, together with unconstrained transitive dependencies, to be installed. The update mode explicitly selects the newest version available from the configured package index. `pyannote.audio`, `torch`, and `torchaudio` are likewise installed without exact version or integrity constraints. Python package installation and subsequent import can execute code with the privileges of the user running setup or the Skill. Therefore, registry compromise, maintainer-account compromise, a malicious future release, or unsafe package-index configuration can turn installation or update operations into local code execution. No evidence was found that the currently named packages are typosquatted or intentionally malicious. The confirmed weakness is the absence of reproducible version and integrity controls. ### Attack Path 1. ...[truncated 927 chars]
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (28)

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
96% confidence
Finding

The skill documents capabilities that read/write files, invoke shell commands, access environment-resident secrets, and make network requests, but it declares no explicit tool scope or permission boundaries. In an agent setting, that gap can lead to over-broad execution authority, making risky behaviors like arbitrary URL fetching, local file writes, and shell invocation available without clear policy enforcement.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The skill is presented as 'local speech-to-text', but the documentation also includes remote model downloads, URL/YouTube/RSS fetching, HuggingFace token use, and an API server mode. That mismatch can mislead users and policy systems into treating the skill as offline-only when it can initiate external network activity and expose local services.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The skill describes URL, RSS, and YouTube inputs that automatically download remote content, but it does not prominently warn that doing so contacts third-party services and may transmit IP address, request metadata, feed access patterns, or authentication-linked model-download activity. Users may reasonably assume 'local' means no network disclosure, making this omission security-relevant.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The trigger phrases include broad, everyday language such as 'what did they say' and 'make a transcript', which can cause accidental or overly eager invocation by an agent router. In a skill with file, shell, and network capabilities, unintended activation increases the chance of processing sensitive media or fetching remote content without sufficiently explicit user intent.

Content

No source excerpt is available for this finding.

Whitespace Padding

Medium
Category
Prompt Injection
Confidence
70% confidence
Finding

Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Content

Scanner excerpt · SKILL.md (reported line 186)May include surrounding context.

md
## Quick Reference

| Task                           | Command                                                                                | Notes                                               |
| ------------------------------ | -------------------------------------------------------------------------------------- | --------------------------------------------------- |
| **Basic transcription**        | `./scripts/transcribe audio.mp3`                                                       | Batched inference, VAD on, distil-large-v3.5        |
| **SRT subtitles**              | `./scripts/transcribe audio.mp3 --format srt -o subs.srt`                              | Word timestamps auto-enabled                        |

Rp1

Medium
Category
MCP Rug Pull
Confidence
86% confidence
Finding

The documentation references running a container from ghcr.io/speaches-ai/speaches:latest-cuda, which is a mutable tag rather than a pinned immutable digest. If the upstream image changes or is compromised, users may unknowingly execute different code than expected, creating a supply-chain risk.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
80% confidence
Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 1010)May include surrounding context.

md
- **OOM**: Lower `--batch-size` (try 4) if you hit out-of-memory errors
- **Pre-convert to WAV** (optional): `ffmpeg -i input.mp3 -ar 16000 -ac 1 input.wav` converts to 16kHz mono WAV before transcription. Benefit is minimal (~5%) for one-off use since PyAV decodes efficiently — most useful when re-processing the same file multiple times (research/experiments) or when a format causes PyAV decode issues. Note: `--normalize` and `--denoise` already perform this conversion automatically.
- **Silero VAD V6**: faster-whisper 1.2.1 upgraded to Silero VAD V6 (improved speech detection). Run `./setup.sh --update` to get it.
- **Batched silence removal**: faster-whisper 1.2.0+ automatically removes silence in `BatchedInferencePipeline` (used by default). Upgrade with `./setup.sh --update` to get this if you installed before August 2024.

## Why faster-whisper?

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
98% confidence
Finding

The HTML formatter injects unescaped file names, plain segment text, speaker labels, and especially word tokens directly into HTML markup. Because transcript content can come from attacker-controlled audio or remote media, this can produce stored XSS when the generated HTML is opened in a browser.

Content

No source excerpt is available for this finding.

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/transcribe.py (reported line 582)May include surrounding context.

python
if not quiet:
        print(f"🎚️  Extracting {channel} channel...", file=sys.stderr)
    try:
        subprocess.run(cmd, check=True, capture_output=True)
        return tmp_path, tmp_path
    except subprocess.CalledProcessError:
        if not quiet:

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/transcribe.py (reported line 790)May include surrounding context.

python
if not quiet:
        print(f"🎚️  Extracting {channel} channel...", file=sys.stderr)
    try:
        subprocess.run(cmd, check=True, capture_output=True)
        return tmp_path, tmp_path
    except subprocess.CalledProcessError:
        if not quiet:

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/transcribe.py (reported line 942)May include surrounding context.

python
if not quiet:
        print(f"🎚️  Extracting {channel} channel...", file=sys.stderr)
    try:
        subprocess.run(cmd, check=True, capture_output=True)
        return tmp_path, tmp_path
    except subprocess.CalledProcessError:
        if not quiet:

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/transcribe.py (reported line 788)May include surrounding context.

python
]
        if not quiet:
            print(f"🎬 Burning subtitles into {output_path}...", file=sys.stderr)
            subprocess.run(cmd, check=True)
        else:
            subprocess.run(cmd, check=True, capture_output=True)
        if not quiet:

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

The code downloads audio from arbitrary URLs with yt-dlp and fetches podcast RSS feeds via urllib, which sends user-provided network destinations and may expose system IP/addressing information to third parties. Although there are progress messages, there is no clear user disclosure in comments, help text, or prompts warning that remote services will be contacted and external content downloaded.

Content

No source excerpt is available for this finding.

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/transcribe.py (reported line 827)May include surrounding context.

python
print("⬇️  Downloading audio from URL...", file=sys.stderr)

    try:
        subprocess.run(cmd, check=True, capture_output=quiet)
    except subprocess.CalledProcessError as e:
        print(f"Error downloading URL: {e}", file=sys.stderr)
        shutil.rmtree(tmpdir, ignore_errors=True)

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/transcribe.py (reported line 1152)May include surrounding context.

python
if not audio_path.lower().endswith(".wav"):
        tmp_wav = audio_path + ".diarize.wav"
        try:
            subprocess.run(
                ["ffmpeg", "-y", "-i", audio_path, "-ar", "16000", "-ac", "1", tmp_wav],
                check=True, capture_output=True,
            )

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/transcribe.py (reported line 1313)May include surrounding context.

python
)

        try:
            subprocess.run(cmd, check=True, stderr=subprocess.DEVNULL if quiet else None)
            if not quiet:
                print(f"   💾 {out_file}", file=sys.stderr)
        except subprocess.CalledProcessError as e:

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

A transcription skill does not need the ability to modify its installed package set during routine use, yet this file implements exactly that. Self-update materially increases supply-chain exposure and weakens change control because a user-invoked flag can pull and execute new dependency code from remote repositories.

Content

No source excerpt is available for this finding.

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
95% confidence
Finding

The skill includes a self-update path that executes package-manager commands to fetch and install newer code at runtime, which exceeds the minimal requirements of a local transcription tool. This expands the trust boundary to remote package sources and can introduce unreviewed code changes or supply-chain compromise into the skill environment.

Content

Scanner excerpt · scripts/transcribe.py (reported line 1925)May include surrounding context.

python
if "--update" in sys.argv:
        _venv_python = _SCRIPT_DIR.parent / ".venv" / "bin" / "python"
        if shutil.which("uv"):
            subprocess.run(
                ["uv", "pip", "install", "--python", str(_venv_python), "--upgrade", "faster-whisper"],
                check=True,
            )

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
95% confidence
Finding

Like the adjacent uv-based branch, this pip-based self-update command installs the latest faster-whisper package into the skill venv on demand. That creates avoidable supply-chain and integrity risk because executing the skill can modify its own code dependencies from the network without any pinning or review.

Content

Scanner excerpt · scripts/transcribe.py (reported line 1930)May include surrounding context.

python
check=True,
            )
        else:
            subprocess.run(
                [str(_venv_python), "-m", "pip", "install", "--upgrade", "faster-whisper"],
                check=True,
            )

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/transcribe.py (reported line 2584)May include surrounding context.

python
import subprocess as _sp
                    cmd = ["ffmpeg", "-i", path, "-ar", str(sampling_rate), "-ac", "1",
                           "-f", "f32le", "-"]
                    result = _sp.run(cmd, capture_output=True, check=True)
                    return np.frombuffer(result.stdout, dtype=np.float32)

        exit_code = 0

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
70% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · setup.sh (reported line 196)May include surrounding context.

sh
if [ "$OS_TYPE" = "macos" ]; then
        echo "   brew install ffmpeg"
    else
        echo "   Ubuntu/Debian: sudo apt install ffmpeg"
        echo "   Fedora: sudo dnf install ffmpeg"
        echo "   Arch: sudo pacman -S ffmpeg"
    fi

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
70% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · setup.sh (reported line 197)May include surrounding context.

sh
if [ "$OS_TYPE" = "macos" ]; then
        echo "   brew install ffmpeg"
    else
        echo "   Ubuntu/Debian: sudo apt install ffmpeg"
        echo "   Fedora: sudo dnf install ffmpeg"
        echo "   Arch: sudo pacman -S ffmpeg"
    fi

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
70% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · setup.sh (reported line 198)May include surrounding context.

sh
if [ "$OS_TYPE" = "macos" ]; then
        echo "   brew install ffmpeg"
    else
        echo "   Ubuntu/Debian: sudo apt install ffmpeg"
        echo "   Fedora: sudo dnf install ffmpeg"
        echo "   Arch: sudo pacman -S ffmpeg"
    fi

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The manifest declares access to a local Hugging Face authentication token path, which can expose credentials usable to access private models or account-scoped resources. In a speech-to-text skill, that access is not clearly justified in the user-facing metadata, so users may not realize the skill can read sensitive local secrets if optional functionality is triggered.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low
Category
Supply Chain
Confidence
94% confidence
Finding

The dependency is specified with a lower bound only, which allows future unreviewed versions of faster-whisper to be installed. This creates supply-chain risk because a malicious or breaking upstream release could be pulled into the environment without explicit approval, affecting a security-sensitive package that processes external media inputs.

Content

Scanner excerpt · requirements.txt (reported line 2)May include surrounding context.

text
# Core dependency — PyTorch installed separately by setup script (with CUDA if GPU detected)
faster-whisper>=1.2.1

Static analysis

No suspicious patterns detected.