turbo-whisper-local-stt

• Outcome: Review
• Latest audit: Jul 3, 2026 · 2:27 PM UTC
• Version: 1.0.8

Overview

This audio transcription skill is functional in purpose, but it automatically changes Python environments and may download packages and models despite strong offline/privacy claims.

Install only if you are comfortable with first-run internet access, large package/model downloads, and Python environment changes. Prefer running it in an isolated virtual environment or container, predownload models for sensitive/offline use, and choose an output directory that is safe for confidential transcripts.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (28)

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

"""专门为老项目（使用 pkg_resources 的 setup.py）修复 setuptools 版本"""
    try:
        # 先强制修复损坏的 packaging 包（关键！解决无RECORD文件报错）
        subprocess.check_call([
            sys.executable, "-m", "pip", "install",
            "--verbose", "--ignore-installed", "--no-deps", "packaging==26.1"
        ])

• Confidence: 94% confidence
• Finding: This subprocess call automatically invokes pip at import time to reinstall the packaging library, modifying the Python environment without user consent. Even though the command itself is fixed rather than shell-injected, it enables network/package-supply-chain risk and breaks the skill's stated offline/local trust model.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

"--verbose", "--ignore-installed", "--no-deps", "packaging==26.1"
        ])
        # 再安装兼容的 setuptools + wheel
        subprocess.check_call([
            sys.executable, "-m", "pip", "install",
            "--verbose", "--force-reinstall", "setuptools<=81.2.0", "wheel"
        ])

• Confidence: 94% confidence
• Finding: This call force-reinstalls setuptools and wheel during import, which can unexpectedly alter the runtime environment and affect unrelated packages. In the context of a local STT skill, silently downgrading or replacing packaging infrastructure is especially risky because it expands attack surface and violates least surprise.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

cmd.extend(["-i", "https://pypi.tuna.tsinghua.edu.cn/simple"])

    try:
        subprocess.check_call(cmd)
        logger.info(f"✅ {spec} 安装/升级完成！")
        
    except subprocess.CalledProcessError as e:

• Confidence: 97% confidence
• Finding: This subprocess call installs an arbitrary package spec that may point to PyPI, a URL, git repository, wheel, or zip, allowing execution of third-party code through pip. In a skill advertised as fully offline/local audio transcription, network-capable package installation is highly dangerous because it can fetch and run remote code and silently alter the host environment.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

logger.warning(f"🔧 正在安装 {install_str} ...")

    try:
        subprocess.check_call([
            sys.executable, "-m", "pip", "install",
            install_str,
            "-i", "https://pypi.tuna.tsinghua.edu.cn/simple",

• Confidence: 95% confidence
• Finding: This function performs package installation from an assembled package/version string, again modifying the environment and potentially downloading code from external indexes. Although narrower than the generic installer, it still permits silent dependency changes at runtime, which is unsafe for an offline local skill.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

sys.executable, "-m", "pip", "install",
                        "--upgrade", fallback_zip, "--verbose"
                    ]
                    subprocess.check_call(cmd_fallback)
                    logger.info(f"✅ 使用本地包 {fallback_zip} 安装成功！")
                    return
                except subprocess.CalledProcessError as e2:

• Confidence: 95% confidence
• Finding: The fallback installation of a local zip package still executes package installation logic and may run arbitrary setup/build code from an untrusted archive. Accepting a zip path as recovery behavior increases supply-chain risk and provides another route for unauthorized code execution and environment tampering.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

logger.info("虚拟环境创建成功")

        logger.info("正在升级 pip...")
        subprocess.check_call([str(venv_python), "-m", "pip", "install", "--upgrade", "pip"])

    # ==================== 检查 PyTorch GPU 是否已安装 ====================
    if Path(venv_python).exists() and is_torch_gpu_installed(venv_python):

• Confidence: 92% confidence
• Finding: This code automatically upgrades pip at runtime, causing network access and execution of downloaded package code during installation. In the context of a skill advertised as fully offline and limited to local audio processing, hidden dependency installation materially expands the trust boundary and creates supply-chain and unexpected network-execution risk.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

# 安装 PyTorch
        logger.info("正在安装 PyTorch（~2-3GB，请耐心等待）...")
        subprocess.check_call([
            str(venv_python), "-m", "pip", "install", "torch", "torchvision", "torchaudio",
            "--index-url", index_url
        ])

• Confidence: 95% confidence
• Finding: Installing torch/torchvision/torchaudio from a remote index at runtime downloads and executes third-party code with the user's privileges. This is especially risky because the skill claims offline/local-only behavior, so users would not reasonably expect network activity or large dependency installation during use.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

logger.info("安装 audio-separator CPU 版 + librosa...")
            subprocess.check_call([str(venv_python), "-m", "pip", "install", "audio-separator[cpu]", "librosa"])

        subprocess.check_call([str(venv_python), "-m", "pip", "install", "pydub"])
        subprocess.check_call([str(venv_python), "-m", "pip", "install", "huggingface-hub[tqdm]"])
        
        logger.info("✅ 虚拟环境及所有依赖安装完成！")

• Confidence: 88% confidence
• Finding: Runtime installation of pydub triggers network retrieval and execution of package installation logic, expanding the skill's behavior beyond local transcription. While common in bootstrap scripts, it still creates avoidable supply-chain risk and contradicts the stated offline/privacy-safe positioning.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

subprocess.check_call([str(venv_python), "-m", "pip", "install", "audio-separator[cpu]", "librosa"])

        subprocess.check_call([str(venv_python), "-m", "pip", "install", "pydub"])
        subprocess.check_call([str(venv_python), "-m", "pip", "install", "huggingface-hub[tqdm]"])
        
        logger.info("✅ 虚拟环境及所有依赖安装完成！")

• Confidence: 90% confidence
• Finding: Automatically installing huggingface-hub at runtime introduces external network dependency and third-party code execution. That is more concerning here because the skill markets itself as offline and only handling local audio, so users may not consent to or monitor this extra behavior.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

# 安装 audio-separator + librosa（你提到的）
        if use_gpu:
            logger.info("安装 audio-separator GPU 版 + librosa...")
            subprocess.check_call([str(venv_python), "-m", "pip", "install", "audio-separator[gpu]", "librosa"])
        else:
            logger.info("安装 audio-separator CPU 版 + librosa...")
            subprocess.check_call([str(venv_python), "-m", "pip", "install", "audio-separator[cpu]", "librosa"])

• Confidence: 90% confidence
• Finding: Installing audio-separator[gpu] at runtime downloads substantial third-party code unrelated to the minimum required functionality for speech-to-text. Because source-separation capability also exceeds the stated purpose of local transcription, this broadens both operational scope and supply-chain exposure.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

subprocess.check_call([str(venv_python), "-m", "pip", "install", "audio-separator[gpu]", "librosa"])
        else:
            logger.info("安装 audio-separator CPU 版 + librosa...")
            subprocess.check_call([str(venv_python), "-m", "pip", "install", "audio-separator[cpu]", "librosa"])

        subprocess.check_call([str(venv_python), "-m", "pip", "install", "pydub"])
        subprocess.check_call([str(venv_python), "-m", "pip", "install", "huggingface-hub[tqdm]"])

• Confidence: 89% confidence
• Finding: This runtime installation of audio-separator[cpu] and librosa similarly performs unexpected network-backed code installation. The risk is not shell injection but unannounced dependency acquisition and execution in a skill presented as local-only and narrowly scoped.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 95% confidence
• Finding: The skill declares no permissions while instructing the agent to invoke Python, execute shell commands, inspect the environment, and write output files. This under-declaration is dangerous because it hides materially sensitive capabilities from policy enforcement and from users, increasing the chance that command execution, package installation, and filesystem changes occur without informed consent.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: The skill claims to be fully offline and limited to local audio transcription, but the documented behavior indicates package installation, online model retrieval, GPU/CUDA probing, virtualenv creation, audio slicing, and metadata generation. This mismatch is dangerous because users may authorize the skill expecting narrow offline transcription while it performs broader system modification and possible network activity, expanding both privacy and supply-chain risk.

Context-Inappropriate Capability

High

• Confidence: 99% confidence
• Finding: The file is an installer utility that can fetch and install packages from PyPI or git, which is unrelated to the declared purpose of local/offline speech transcription. This mismatch is dangerous because it introduces remote code execution and supply-chain behavior into a skill users would reasonably trust to stay local.

Description-Behavior Mismatch

High

• Confidence: 99% confidence
• Finding: The code explicitly supports network-capable installation from package indexes and git repositories despite the manifest emphasizing offline/local behavior. This contradiction materially increases risk because users may expose systems they believe are air-gapped or privacy-preserving to external downloads and execution of untrusted dependency code.

Intent-Code Divergence

Medium

• Confidence: 88% confidence
• Finding: The module documentation advertises itself as an intelligent package installation tool, which conflicts with the skill's stated audio-transcription purpose and signals scope creep into environment modification. While documentation alone is not code execution, this mismatch supports the presence of hidden or unjustified capability and raises the severity of the actual installer functions in context.

Description-Behavior Mismatch

High

• Confidence: 99% confidence
• Finding: The script performs extensive online dependency installation despite the skill description promising fully offline, privacy-safe, local-audio-only behavior. This mismatch is security-relevant because it changes the user's trust assumptions, introduces supply-chain exposure, and may leak metadata through network access even if audio content itself is local.

Context-Inappropriate Capability

Medium

• Confidence: 94% confidence
• Finding: Including audio-separator introduces source-separation functionality beyond simple speech-to-text. Extra media-processing capability increases attack surface and operational scope without clear justification in this skill, which makes the package choice suspicious and less aligned with least privilege/minimal functionality.

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: The skill advertises itself as fully local/offline, yet it can install Python packages and fetch models from the network at runtime. This creates a trust-boundary violation: users or downstream agents may permit it under offline/privacy assumptions while it actually performs external network activity and imports third-party code dynamically.

Intent-Code Divergence

High

• Confidence: 97% confidence
• Finding: Claiming the tool is completely offline while it actively downloads models is security-relevant because users may rely on that representation for privacy-sensitive audio. In this context, the misleading claim increases danger: audio-transcription skills often process confidential recordings, and any undeclared online dependency undermines user consent and network isolation expectations.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The README explicitly advertises automatic model downloads from Hugging Face on first run, but does not clearly warn users that this causes outbound network access and may disclose metadata such as IP address, environment details, and model selection to a third party. In a skill marketed as '完全本地离线运行' and '隐私安全', this omission is security-relevant because users may reasonably assume no network activity occurs at runtime.

Vague Triggers

Medium

• Confidence: 84% confidence
• Finding: The trigger examples are broad enough to match common phrases like '帮我转录' or '生成字幕' without consistently requiring an audio file or folder. Ambiguous activation can cause the wrong skill to run on unintended inputs, leading to unnecessary shell execution, file writes, or attempts to process unsupported content.

Vague Triggers

Medium

• Confidence: 82% confidence
• Finding: The trigger section describes generic transcription requests as activation conditions, which can overmatch everyday language and cause accidental invocation. In a skill that can spawn Python and modify local files, imprecise routing increases the risk of unintended execution and user surprise.

Missing User Warnings

Medium

• Confidence: 87% confidence
• Finding: The skill defaults to writing transcription outputs into local files but does not prominently warn users in the description. This is risky because transcriptions often contain sensitive speech content, and silent local persistence can create privacy exposure, overwrite concerns, or leave sensitive data in shared directories.

Natural-Language Policy Violations

Medium

• Confidence: 74% confidence
• Finding: A Chinese-first preference without clear user opt-in can bias automatic language detection and degrade transcription accuracy for non-Chinese audio. While not directly an exploit primitive, it can lead to incorrect handling of user data and unexpected processing behavior, especially for multilingual or English recordings.

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

No suspicious patterns detected.