Security audit

AssemblyAI advanced speech transcription

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly a coherent AssemblyAI transcription helper, but it can send API keys and sensitive media to arbitrary configured endpoints and can delete remote transcripts without confirmation.

Review this skill before installing in sensitive environments. Use only official AssemblyAI HTTPS endpoints, avoid setting custom base URL environment variables from untrusted contexts, do not process confidential recordings without approval, and treat the delete command as irreversible unless the package adds stronger confirmation controls.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Error

Location: scripts/assemblyai.mjs:23
Finding: Unrestricted custom API endpoints can receive AssemblyAI credentials and sensitive media
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (11)

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 38)May include surrounding context.
md
1. **A no-dependency Node CLI** in `scripts/assemblyai.mjs` (and a compatibility wrapper at `assemblyai.mjs`)

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 257)May include surrounding context.
md
1. **A no-dependency Node CLI** in `scripts/assemblyai.mjs` (and a compatibility wrapper at `assemblyai.mjs`)

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 89% confidence
Finding: The skill explicitly requires internet access and an API key, but it does not declare an explicit tool scope such as permissions or allowed-tools. That weakens containment and reviewability because an agent may invoke network and environment-backed behavior without a machine-readable policy boundary, increasing the chance of unintended data egress or broader-than-expected execution.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The skill handles local audio files and remote URLs by sending content to AssemblyAI, but the user-facing description and operating guidance do not present this as a clear warning before use. This creates a meaningful privacy and compliance risk because users may provide sensitive recordings without realizing the content will leave the local environment and be processed by a third-party service.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The documentation states that transcript text is sent to AssemblyAI's external LLM Gateway endpoint, but it does not provide an explicit warning about privacy, data handling, or the fact that potentially sensitive transcript contents leave the local environment. In a transcription skill, users may process meetings, calls, or other confidential audio, so silently forwarding transcript text to a separate LLM service creates a meaningful data exposure risk.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The workflow recipes instruct agents to send local audio files, URLs, transcript IDs, and transcript-derived prompts/schemas to AssemblyAI transcription and LLM endpoints, but they do not warn that potentially sensitive audio and transcript content is being transmitted to third-party services. In an agent context, these examples can be used as copy-paste defaults, increasing the chance that private meetings, calls, or regulated data are uploaded without an explicit user confirmation or privacy check.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The skill includes an llm command that forwards transcript content to AssemblyAI's remote LLM Gateway, but the visible workflow description does not clearly warn about additional downstream data transmission. In privacy-sensitive environments, transcripts may contain confidential or regulated data, so silently sending them to another remote service can violate user expectations and data-handling policies.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The delete command executes irreversible remote deletion without any confirmation prompt, secondary acknowledgement flag, or prominent warning. In an automated or agent-driven workflow, this creates a realistic risk of accidental or manipulated transcript destruction from a single command invocation.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: When given a local path, the transcribe command uploads the local audio file to a remote API, but there is no explicit privacy or exfiltration warning at the point of use. Because audio often contains sensitive personal or business information, agent users may unknowingly cause remote transfer of confidential data.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The script exposes a delete command that performs remote transcript deletion, which is a destructive capability outside the core transcribe/format workflow described in the skill metadata. In an agent context, adding unnecessary destructive operations increases the chance of accidental or instruction-induced data loss, especially because deletion is a single-step API action.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: Remote deletion is not needed to satisfy the stated use case of transcription, diarization, translation, and formatting, so its presence expands the skill’s authority beyond least privilege. If an agent is prompted or tricked into invoking it, users can lose transcripts irreversibly without expecting that the skill even had deletion powers.
Content: No source excerpt is available for this finding.

Static analysis

Detected: suspicious.env_credential_access

Environment variable access combined with network send.

Critical

Code: suspicious.env_credential_access
Location: scripts/assemblyai.mjs:23