Security audit
Security checks across malware telemetry and agentic risk
This transcription skill does not look intentionally harmful, but it needs Review because it can fetch remote media and persistently change its own runtime dependency.
Install only if you are comfortable giving this skill access to local media files, generated transcript outputs, outbound downloads from user-provided URLs or feeds, and optional HuggingFace credentials. Avoid using the --update feature in normal runs; update dependencies through a controlled package-management process instead, and run remote-media transcription in a constrained workspace.
)
try:
subprocess.run(cmd, check=True, stderr=subprocess.DEVNULL if quiet else None)
if not quiet:
print(f" 💾 {out_file}", file=sys.stderr)
except subprocess.CalledProcessError as e:if "--update" in sys.argv:
_venv_python = _SCRIPT_DIR.parent / ".venv" / "bin" / "python"
if shutil.which("uv"):
subprocess.run(
["uv", "pip", "install", "--python", str(_venv_python), "--upgrade", "faster-whisper"],
check=True,
)check=True,
)
else:
subprocess.run(
[str(_venv_python), "-m", "pip", "install", "--upgrade", "faster-whisper"],
check=True,
)print(f"🎬 Burning subtitles into {output_path}...", file=sys.stderr)
subprocess.run(cmd, check=True)
else:
subprocess.run(cmd, check=True, capture_output=True)
if not quiet:
print(f"✅ Burned: {output_path}", file=sys.stderr)
except subprocess.CalledProcessError as e:# Core dependency — PyTorch installed separately by setup script (with CUDA if GPU detected) faster-whisper>=1.2.1
66/66 vendors flagged this skill as clean.
No suspicious patterns detected.