Local Whisper (cpp)

• Outcome: Pass
• Latest audit: Sep 10, 2026 · 7:59 PM UTC
• Version: 1.0.0

Overview

This skill is a straightforward local Whisper transcription wrapper, with setup integrity and system-path cautions users should review.

Before installing, prefer downloading the model as an unprivileged user, verify the source and checksum if available, and avoid running the download or transcription command with more privileges than necessary.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:29

Finding

Unverified Model Download from a Mutable Upstream Branch

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 29–33
Vulnerability Type: Insecure third-party model retrieval
Risk Level: Medium

markdown

Download the model to `/usr/share/whisper.cpp-model-large-v3-turbo/`:
```bash
wget https://huggingface.co/ggerganov/whisper.cpp/resolve/main/ggml-large-v3-turbo.bin?download=true -O /usr/share/whisper.cpp-model-large-v3-turbo/ggml-large-v3-turbo.bin

text

### Technical Analysis

The documented setup command downloads a third-party model from the mutable `main` branch and writes it directly to a system-wide model path. It does not pin an immutable release or commit and does not verify a cryptographic digest or signature.

HTTPS protects the download in transit, but it does not establish that the retrieved artifact is identical to the artifact reviewed or intended by the Skill author. If the upstream repository, hosting account, or mutable artifact is compromised or replaced, users following the setup instructions could silently install attacker-controlled or otherwise unexpected model data.

The command also writes directly to the final destination rather than downloading to a temporary file, validating it, and atomically moving it into place. An interrupted download could therefore leave a truncated or corrupt model at the path later consumed by `whisper-cli`.

### Attack Path

1. An attacker compromises the upstream repository, hosting account, or artifact referenced through the mutable `main` branch.
2. The attacker replaces the model with a maliciously crafted or behaviorally modified artifact.
3. A user follows the documented `wget` command.
4. The unverified bytes are written directly to `/usr/share/whisper.cpp-model-large-v3-turbo/ggml-large-v3-turbo.bin`.
5. The wrapper invokes `whisper-cli`, which loads and parses the substituted artifact.
6. The modified model may manipulate transcription results; if it triggers a vulnerability in the native model p
...[truncated 859 chars]

Remediation

View remediation

Remediation Suggestions

1. Reference an immutable release or commit rather than the mutable main branch.
2. Publish a trusted SHA-256 or stronger digest for the expected model and verify it before installation.
3. Prefer a signed release and validate its signature against a documented, trusted public key.
4. Download into a securely created temporary file rather than directly overwriting the final model.
5. Reject the artifact if its digest, signature, expected size, or format validation fails.
6. Move the verified temporary file atomically into the destination and assign restrictive ownership and permissions.
7. Document the exact model version and digest so administrators can reproduce and audit the installation.
8. Avoid running the downloader or transcription process with greater privileges than necessary.

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

The markdown instructs the user to place a model under /usr/share/... using wget -O, which writes to a system-owned path and may require sudo or alter shared system state. The skill description does not warn that this setup step modifies a protected directory or may need elevated permissions.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.