Voice To Text

• Outcome: Review
• Latest audit: Sep 10, 2026 · 8:07 PM UTC
• Version: 1.0.0

Overview

This is a coherent offline transcription skill, but its temporary audio handling can expose or overwrite local files in some environments.

Install only if you are comfortable with local processing of audio files and the current temporary-file risk. Avoid using it for sensitive recordings or on shared/multi-user machines until the script uses a private unique temporary directory and reliable cleanup.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: transcribe.py:75

Finding

Predictable Shared Temporary File Enables File Clobbering and Audio Disclosure

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (8)

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 89% confidence

Finding

The skill clearly instructs use of shell execution and environment variables, but it does not declare any explicit tool scope or permissions. That weakens containment and reviewability because an agent may invoke shell-capable behavior without a narrowly declared boundary, increasing the chance of unintended command execution or broader system access.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The description says to use the skill whenever a user sends a voice message, audio file, or asks to transcribe speech to text, which is broad enough to trigger on many normal conversations without strong gating. In an agent setting, overly broad invocation criteria can cause automatic processing of user files or paths with insufficient confirmation, raising privacy and misuse risks.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 52)May include surrounding context.

2. Download a Vosk model:

   bash

   mkdir -p ~/.vosk/models && cd ~/.vosk/models
   
   # Chinese (small, fast)
   curl -LO https://alphacephei.com/vosk/models/vosk-model-small-cn-0.22.zip
   

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · transcribe.py (reported line 23)May include surrounding context.

python

missing.append("vosk (pip install vosk)")

    try:
        subprocess.run(["ffmpeg", "-version"], capture_output=True, check=True)
    except (subprocess.CalledProcessError, FileNotFoundError):
        missing.append("ffmpeg (brew install ffmpeg)")

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The model selection logic explicitly prefers Chinese models first, and the setup instructions likewise present the Chinese model as the default recommendation. This imposes a language/locale choice on users without offering an explicit opt-in or selection mechanism.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · transcribe.py (reported line 63)May include surrounding context.

python

"-f", "wav",
        output_file
    ]
    result = subprocess.run(cmd, capture_output=True, text=True)
    if result.returncode != 0:
        raise RuntimeError(f"FFmpeg error: {result.stderr}")
    return output_file

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · transcribe.py (reported line 96)May include surrounding context.

python

convert_to_wav(audio_file, temp_wav)
        wf = wave.open(temp_wav, "rb")

    # Create recognizer
    rec = KaldiRecognizer(model, wf.getframerate())
    rec.SetWords(True)

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 80% confidence

Finding

The skill does not prominently warn users that supplied voice messages and audio files will be locally decoded, converted, and transcribed. While local processing is better than remote exfiltration, the absence of a user-facing notice can still lead to unexpected handling of sensitive audio content and metadata.

Content

No source excerpt is available for this finding.