Whisper Transcriber

• Outcome: Review
• Latest audit: Sep 11, 2026 · 8:35 AM UTC
• Version: 1.0.0

Overview

This skill appears intended for local speech transcription, but it asks users to run shell installers that can change system packages and download persistent model files without effective integrity checks.

Review this before installing. Run the installer only if you are comfortable with it using sudo/package-manager commands and downloading Whisper model files. Prefer manually installing dependencies, pinning or verifying model checksums, and storing transcripts carefully because local output files can contain sensitive speech content.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: config.json:17
• Finding: Whisper Models Are Downloaded Without Effective Integrity Verification## Vulnerability Details **File Location**: `config.json:17-23`, `scripts/install.sh:181-214, 242-250`, and `scripts/transcribe.sh:141-173, 200-216` **Vulnerability Type**: Supply-chain integrity failure for remotely downloaded model files **Risk Level**: Medium ### Vulnerable Code `config.json:17-23`: ```json "modelsSha256": { "tiny": "", "base": "", "small": "", "medium": "", "large": "" } ``` `scripts/install.sh:181-214`: ```bash expected_sha256_for_model() { local model_name="$1" local cfg="$SKILL_DIR/config.json" if [ -f "$cfg" ]; then node -e " const fs=require('fs'); try{ const j=JSON.parse(fs.readFileSync(process.argv[1],'utf8')); const v=(j.modelsSha256||{})[process.argv[2]]||''; process.stdout.write(String(v)); }catch(e){process.stdout.write('');} " "$cfg" "$model_name" fi } verify_model_sha256_if_available() { local model_name="$1" local path="$2" local expected actual expected="$(expected_sha256_for_model "$model_name")" if [ -z "$expected" ]; then return 0; fi actual="$(sha256_file "$path" || true)" if [ -z "$actual" ]; then warn "Cannot compute sha256 (missing shasum/sha256sum); skipping verification" return 0 fi if [ "$actual" != "$expected" ]; then err "Model sha256 mismatch: $path" err "expected: $expected" err "actual: $actual" return 1 fi ok "Model sha256 OK: $model_name" } ``` `scripts/install.sh:242-250`: ```bash local url="https://huggingface.co/ggerganov/whisper.cpp/resolve/main/$mf" step "Downloading model: $model_name ($(model_size "$model_name"))" log "URL: $url" log "To: $target" if need_cmd curl; then curl -L --fail --progress-bar "$url" -o "$target" elif need_cmd wget; then wget -c "$url" -O "$target" fi ``` `scripts/transcribe.sh:200-216`: ```bash local download_url="https://huggingface.co/ggerganov/whisper.cpp/resolve/main/$model_file" if command -v wget &> /dev/null; then wget -c "$download_url" ...[truncated 2687 chars]
• Remediation: ## Remediation Suggestions 1. Populate `modelsSha256` with independently verified SHA-256 values for every supported model. 2. Fail closed when an expected digest is absent or when neither `sha256sum` nor `shasum` is available. 3. Pin each download to an immutable, reviewed upstream commit or release rather than `resolve/main`. 4. Download into a securely created temporary file in the destination directory. 5. Require successful HTTP status handling with `curl --fail --location` or an equivalent strict `wget` invocation. 6. Verify the temporary file before moving it atomically to the final model path. 7. Delete temporary, partial, or mismatched files on every failure. 8. Verify already cached models before accepting them rather than returning immediately when the target exists. 9. Consider signed release manifests or another authenticated artifact-signing mechanism in addition to checksums.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults

Findings (23)

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

;;
    pacman)
      step "Installing via pacman: ${pkgs[*]}"
      sudo pacman -Sy --noconfirm "${pkgs[@]}"
      ;;
    zypper)
      step "Installing via zypper: ${pkgs[*]}"

• Confidence: 85% confidence
• Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Natural-Language Policy Violations

Medium

• Confidence: 87% confidence
• Finding: The top-level skill description is written as a Chinese-only tagline, which imposes a specific language on the user-facing documentation without any opt-in or alternative language path. Under the stated policy, forcing a specific language or locale without user choice is a natural-language policy violation.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

Linux（包名可能随发行版不同而不同）：
```bash
# 示例（Debian/Ubuntu）
sudo apt-get update -y
sudo apt-get install -y ffmpeg
# whisper-cli/whisper.cpp 请按发行版包名安装
```

• Confidence: 70% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

Linux（包名可能随发行版不同而不同）：
```bash
# 示例（Debian/Ubuntu）
sudo apt-get update -y
sudo apt-get install -y ffmpeg
# whisper-cli/whisper.cpp 请按发行版包名安装
```

• Confidence: 70% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 90% confidence
• Finding: The skill invokes shell scripts directly (`bash <SKILL_DIR>/scripts/install.sh` and `transcribe.sh`) but does not declare any tool scope such as `permissions` or `allowed-tools`. That creates an undeclared execution boundary: an agent or user may run shell-capable actions without an explicit allowlist, increasing the risk of unintended command execution, dependency installation, network access during model download, or filesystem changes.

Natural-Language Policy Violations

Medium

• Confidence: 92% confidence
• Finding: The file declares `default: "zh"` while supporting both Chinese and English, which can force a specific language/locale behavior by default. The policy requires either explicit user choice or a clearly justified locale constraint; neither is provided here.

Natural-Language Policy Violations

Medium

• Confidence: 95% confidence
• Finding: The config sets "lang": "zh" as a fixed default, which is a natural-language locale choice applied without any indication that users can opt in or select another language. The policy allows locale constraints only when the skill offers a choice or clearly documents a justified region-specific limitation, neither of which is present in this file.

Missing User Warnings

Medium

• Confidence: 85% confidence
• Finding: This markdown file demonstrates processing meeting recordings, interviews, and other speech content into text files, which can affect user privacy and data handling. Under the markdown criteria for SQP-2, the examples omit any caution about sensitive audio, transcript storage, or reviewing where outputs are written.

Natural-Language Policy Violations

Medium

• Confidence: 95% confidence
• Finding: The script hard-codes `LANG="zh"`, which imposes a specific language/locale behavior on all transcriptions. This is a natural-language policy concern because the file provides no user opt-in, override prompt, or documented region-specific justification for forcing Chinese.

Natural-Language Policy Violations

Medium

• Confidence: 95% confidence
• Finding: This markdown file presents all user-facing guidance exclusively in Chinese, including headings, recommendations, and download instructions. Under the policy rule for language/locale, forcing a specific language without user opt-in or documented regional justification is a natural-language policy violation.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

;;
    apt)
      step "Installing via apt: ${pkgs[*]}"
      sudo apt-get update -y
      sudo apt-get install -y "${pkgs[@]}"
      ;;
    dnf)

• Confidence: 70% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

;;
    apt)
      step "Installing via apt: ${pkgs[*]}"
      sudo apt-get update -y
      sudo apt-get install -y "${pkgs[@]}"
      ;;
    dnf)

• Confidence: 70% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

;;
    apt)
      step "Installing via apt: ${pkgs[*]}"
      sudo apt-get update -y
      sudo apt-get install -y "${pkgs[@]}"
      ;;
    dnf)

• Confidence: 70% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

;;
    apt)
      step "Installing via apt: ${pkgs[*]}"
      sudo apt-get update -y
      sudo apt-get install -y "${pkgs[@]}"
      ;;
    dnf)

• Confidence: 70% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

;;
    apt)
      step "Installing via apt: ${pkgs[*]}"
      sudo apt-get update -y
      sudo apt-get install -y "${pkgs[@]}"
      ;;
    dnf)

• Confidence: 70% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

;;
    apt)
      step "Installing via apt: ${pkgs[*]}"
      sudo apt-get update -y
      sudo apt-get install -y "${pkgs[@]}"
      ;;
    dnf)

• Confidence: 70% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

;;
    pacman)
      step "Installing via pacman: ${pkgs[*]}"
      sudo pacman -Sy --noconfirm "${pkgs[@]}"
      ;;
    zypper)
      step "Installing via zypper: ${pkgs[*]}"

• Confidence: 65% confidence
• Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Natural-Language Policy Violations

Medium

• Confidence: 93% confidence
• Finding: The script's user-facing text is entirely in Chinese and the transcription test hard-codes Chinese output context, which imposes a specific language/locale on users without offering a choice. This matches the policy category for language or locale constraints that are not optional or justified as region-specific.

Natural-Language Policy Violations

Medium

• Confidence: 96% confidence
• Finding: The script sets `DEFAULT_LANG` to `zh`, which makes Chinese the default language for transcription unless the user explicitly overrides it. This is a natural-language locale choice imposed by default rather than offered as an opt-in, which can violate language/locale policy requirements.

Description-Behavior Mismatch

Medium

• Confidence: 96% confidence
• Finding: The manifest describes the skill as 'Offline speech-to-text (ASR)', but when a model file is missing the script fetches it from Hugging Face using wget or curl. While model download is mentioned in the manifest, the prominent 'offline' description does not match the script's actual runtime behavior in this path because it performs network access.

External Transmission

Medium

• Category: Data Exfiltration

Content

if command -v wget &> /dev/null; then
            wget -c "$download_url" -O "$model_path"
        elif command -v curl &> /dev/null; then
            curl -L "$download_url" -o "$model_path"
        else
            log_error "需要 wget 或 curl 下载模型"

• Confidence: 70% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Natural-Language Policy Violations

Low

• Confidence: 91% confidence
• Finding: A natural-language policy violation applies when a skill effectively forces a specific language without user opt-in. This file presents all instructions and examples only in Chinese, with no indication of alternative language support or justification for a Chinese-only scope.

Natural-Language Policy Violations

Low

• Confidence: 82% confidence
• Finding: This markdown file contains user-facing instructional text solely in Chinese, and several example commands hard-code `-l zh`. Under the policy rule, forcing a specific language or locale without user opt-in can be a natural-language policy violation when no alternative or choice is presented.

Static analysis

No suspicious patterns detected.