Audio Note Taker

• Outcome: Pass
• Latest audit: Sep 12, 2026 · 1:48 AM UTC
• Version: 1.0.1

Overview

This skill coherently transcribes user-selected audio into notes, but it overstates some features and needs clearer privacy and install guidance.

Install only if you are comfortable sending selected audio to OpenAI-compatible transcription services and saving the resulting transcript on disk. Do not rely on the advertised speaker detection, summarization, or action-item extraction until those features are actually implemented, and consider installing dependencies in an isolated environment because the installer uses an unpinned openai package.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: install.sh:12

Finding

Unbounded and Incorrectly Quoted Python Dependency Installation

Content

View full analysis

Vulnerability Details

File Location: install.sh:12-14
Vulnerability Type: Unbounded third-party dependency installation
Risk Level: Medium

bash

# 安装 Python 依赖
echo "📦 安装 Python 依赖..."
pip3 install --user openai>=1.0.0

The same unbounded constraint is declared in skill.json:19-22:

json

"dependencies": {
  "openai": ">=1.0.0"
},

Technical Analysis

The installer does not pin the openai dependency to a reviewed version and does not use a lockfile or package integrity hashes. Any future version satisfying the declaration can therefore be installed, making installation non-reproducible and expanding exposure to compromised or malicious future releases.

Furthermore, the requirement specifier in the shell command is not quoted. In POSIX-compatible shells, the > character is interpreted as an output-redirection operator. Consequently, the shell can parse the command as an unconstrained installation of openai, with command output redirected to a file named =1.0.0, rather than passing openai>=1.0.0 as one argument to pip3.

Python package installation may invoke package build hooks, while imported package code runs with the privileges of the invoking user. Dependency compromise can therefore become local code execution.

Attack Path

1. An attacker compromises an accepted future release of the dependency or its distribution channel.
2. A user runs install.sh.
3. Because the version specifier is unquoted, the shell may install the latest available openai release without the intended lower-bound expression being passed to pip.
4. Pip downloads and installs the compromised package without checking a lockfile or expected package hash.
5. Malicious code executes through package installation hooks or when audio_note_taker.py imports OpenAI.

Impact Assessment

Successful exploitation would permit code execution with the privileges of the user running the in ...[truncated 359 chars]

Remediation

View remediation

Remediation Suggestions

• Pin the dependency to an exact, reviewed version rather than using an open-ended range.

• Quote requirement specifiers passed through a shell:

  bash

  pip3 install --user 'openai==REVIEWED_VERSION'
  

• Prefer a version-controlled requirements file containing cryptographic hashes:

  text

  openai==REVIEWED_VERSION \
      --hash=sha256:EXPECTED_DISTRIBUTION_HASH
  

  Install it with:

  bash

  python3 -m pip install --user --require-hashes -r requirements.txt
  

• Keep skill.json, the installer, and the lockfile synchronized.

• Review dependency updates before changing the pinned version.

• Install dependencies in an isolated virtual environment rather than modifying the user's general Python environment.

T09 · Insecure Skill Coding Practices

Note

• Location: source/audio_note_taker.py:39

Finding

Untrusted Content Embedded in Markdown Without Escaping

Content

View full analysis

Vulnerability Details

File Location: source/audio_note_taker.py:39-58
Vulnerability Type: Markdown content injection
Risk Level: Low

python

def generate_notes(
    transcript: str,
    title: str,
    detect_speakers: bool = False,
    summarize: bool = False,
    extract_action_items: bool = False
) -> str:
    """生成结构化笔记（简单版）"""
    notes = []

    # 标题
    notes.append(f"# {title}")
    notes.append(f"**生成时间**：{datetime.now().strftime('%Y-%m-%d %H:%M:%S')}")
    notes.append("")

    # 如果开启摘要（需要 LLM，这里先实现基本版）
    if summarize or extract_action_items:
        notes.append("## 📝 智能摘要")
        notes.append("*（需配置 GPT 模型，当前版本暂未启用）*")
        notes.append("")

    # 完整转录
    notes.append("## 📄 完整转录")
    notes.append("```text")
    notes.append(transcript)
    notes.append("```")

Technical Analysis

The title supplied through the command line and the transcript returned by the external transcription service are embedded directly into a Markdown document without escaping or structural validation.

The transcript is intended to be contained in a fenced code block, but a transcript containing a matching triple-backtick sequence can terminate that block. Subsequent transcript content can then be interpreted as Markdown or raw HTML by the viewer. Likewise, a title containing line breaks and Markdown syntax can inject additional document elements after the heading.

Depending on the Markdown renderer, injected content could include deceptive links, images referencing remote servers, or raw HTML. A renderer that automatically loads remote resources could disclose viewer metadata such as the IP address and user-agent string.

Attack Path

1. An attacker supplies crafted audio whose transcribed text includes a triple-backtick fence followed by Markdown or HTML content. Alternatively, a crafted multiline value is supplied through --title.
2. The transcription respons ...[truncated 844 chars]

Remediation

View remediation

Remediation Suggestions

• Escape Markdown metacharacters and normalize line breaks in user-controlled titles before placing them in headings.
• Do not use a fixed triple-backtick delimiter for arbitrary transcript data. Select a fence longer than every consecutive backtick sequence present in the transcript, or encode the transcript using a representation that cannot terminate its container.
• For plain-text output, write the transcript directly without Markdown markup.
• If generated Markdown is rendered by the application, use a renderer configured to disable raw HTML and remote-resource loading.
• Consider representing structured output as JSON first and using a trusted, context-aware Markdown renderer to create the final document.
• Add tests covering transcripts and titles containing backticks, raw HTML, image syntax, links, and embedded newlines.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (9)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

The primary purpose is partially aligned: the script does transcribe audio and save the result as a note. However, key advertised capabilities are missing. The --detect-speakers option is accepted but never used to perform speaker diarization. The --summarize and --extract-action-items options do not invoke any LLM or extraction logic; the code explicitly says these are 'not yet enabled' and only adds a placeholder section. The resulting note is a basic wrapper around the raw transcript rather than the richer structured notes described. There is no evidence of unrelated or dangerous undeclared behavior, but the declared feature set materially overstates the implemented functionality.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 89% confidence

Finding

The skill advertises capabilities that involve environment-variable access and writing files, but it does not declare an explicit tool scope such as permissions or allowed-tools. This weakens least-privilege controls and makes it harder for users or the platform to understand what the skill can access, increasing the chance of unintended data exposure or file modifications.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The skill handles potentially sensitive recordings such as meetings, lectures, and interviews, yet it does not clearly warn that audio may be transmitted to external APIs for transcription or summarization. Users may unknowingly send confidential, personal, or regulated content off-device, creating privacy, compliance, and data-handling risks.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The script's user-facing strings are entirely in Chinese and the quick-start example hard-codes '--language zh'. This imposes a specific language/locale on users without offering a choice or documenting that the skill is intentionally region-specific.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

This manifest contains user-facing natural language in Chinese for the description and author fields, but does not indicate that the skill is region-specific or provide any user opt-in for language preference. That can violate language/locale policy expectations when skills are expected to be usable without forcing a specific language.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The module docstring, argument descriptions, status messages, and setup guidance are all written in Chinese, with no indication that other languages are supported or that the user can choose the interaction language. This creates a natural-language locale constraint that is not presented as optional or justified as region-specific.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The skill advertises speaker identification, automatic summarization, and action-item extraction, but the implementation only produces a raw transcript wrapped in a note template. This is a security-relevant integrity issue because users may rely on missing analysis features for meeting records, compliance notes, or task tracking and make decisions based on incomplete output.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The CLI exposes summarization and action-item extraction flags as if they are functional, while the code explicitly states they are not enabled and still proceeds to generate notes. This can mislead operators into believing structured analysis occurred, creating downstream integrity and workflow risk, especially in enterprise note-taking or evidence-capture contexts.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

The skill writes transcripts and notes to disk but does not clearly warn users of that behavior. For sensitive recordings, unexpected file creation can leave confidential data stored locally in insecure locations, where it may be backed up, synced, or accessed by other users/processes.

Content

No source excerpt is available for this finding.