T09 · Insecure Skill Coding Practices
Error
- Location
scripts/batch_transcribe.py:132- Finding
Unvalidated force-date argument enables arbitrary recursive directory deletion
- Content
View full analysis
- Remediation
View remediation
Security audit
SenseVoice Transcribe
Security checks for vulnerabilities and agentic risk
Overview
This transcription skill is coherent overall, but needs review because some optional flags can delete or overwrite user-controlled paths and send job details to an arbitrary webhook URL.
Review this before installing. Use it only in a constrained working directory, avoid --force-dates unless the arguments are trusted date strings, avoid pointing --progress-file at existing important files, and do not use --discord-webhook unless you are comfortable sending filenames, dates, status, and error details to that endpoint. Prefer pinned dependencies and a sandboxed environment for model downloads and transcription runs.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (4)
T09 · Insecure Skill Coding Practices
Error
- Location
scripts/batch_transcribe.py:43- Finding
Caller-controlled progress path permits arbitrary file overwrite
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/batch_transcribe.py:56- Finding
Unrestricted webhook URL enables server-side request forgery
- Content
View full analysis
- Remediation
View remediation
T08 · Insecure Dependencies
Warning
- Location
SKILL.md:36- Finding
Setup instructions install unpinned dependencies and retrieve mutable model artifacts
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Behavioral ASTexec() Call, eval() Call, Dynamic Import
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (19)
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md The bundled `scripts/batch_transcribe.py` handles the full daylog pipeline:
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md The bundled `scripts/batch_transcribe.py` handles the full daylog pipeline:
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md The bundled `scripts/batch_transcribe.py` handles the full daylog pipeline:
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md The bundled `scripts/batch_transcribe.py` handles the full daylog pipeline:
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md The bundled `scripts/batch_transcribe.py` handles the full daylog pipeline:
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 93% confidence
- Finding
The skill documents shell execution, file writing, and network use but does not declare any tool scope or permissions boundaries. That mismatch increases the risk of over-privileged execution and makes it harder for a caller or runtime to understand that transcription can also write files and send outbound requests.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The sample invocation sets
language='zh'and the parsing logic splits on<|zh|>tags, which forces a specific language behavior. The document does not present this as an opt-in choice or clearly justify that the skill is limited to Chinese-only usage.- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The manifest and description present the skill as a local transcription tool, but the documented batch behavior also performs external Discord notifications. This scope drift is dangerous because operators may grant or run the skill assuming offline processing while it can transmit metadata externally.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
Discord webhook posting introduces an external network channel that is not necessary for core transcription. In a skill handling potentially sensitive audio workflows, even progress or filename metadata sent to a third party can create privacy and data-governance issues beyond the stated purpose.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
Posting transcription progress to Discord can disclose sensitive operational metadata such as processing times, dates, filenames, or activity patterns, yet the skill provides no privacy warning or consent guidance. In the context of daylog audio, that metadata may itself be confidential even if transcript text is not sent.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
The script includes destructive behavior that deletes existing transcripts when --force-dates is used, but the top-level description presents it primarily as a batch transcription tool. That mismatch can lead to accidental data loss because operators may not anticipate recursive deletion of prior outputs.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The script can send transcription job metadata to an external Discord webhook, which introduces outbound data exfiltration capability unrelated to the core local transcription function. Even if it only sends filenames, dates, failure messages, and progress by default, those details can reveal sensitive recording activity and operational information to a third party.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The outbound webhook feature creates an unnecessary network egress path in a transcription utility, expanding the attack surface and enabling unauthorized sharing of job state externally. In a skill expected to process potentially sensitive audio locally, hidden or poorly disclosed network transmission materially increases privacy and compliance risk.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
Webhook notifications transmit operational details without any built-in confirmation, warning banner, or consent mechanism at runtime. In the context of transcription of personal recordings, even metadata such as filenames, dates, counts, and failure traces may expose sensitive information about users and their activities.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The file fixes the language/locale to Chinese via WHISPER_LANG = "zh", and later also passes language="zh" to SenseVoice, with no opt-in or user-selectable alternative. This is a natural-language locale policy concern because it forces a specific language behavior without choice or justification.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The SenseVoice generate call explicitly sets language="zh", which enforces Chinese processing regardless of user preference. Since no language selection mechanism or justification is provided, this constitutes a locale-policy issue under the natural-language rules.
- Content
subprocess module call
Medium
- Category
- Dangerous Code Execution
- Confidence
- 70% confidence
- Finding
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
- Content
python else: # Whisper path (unchanged from v2) import tempfile res = subprocess.run( ['ffmpeg', '-i', str(wav), '-af', f'silencedetect=noise={SILENCE_NOISE_DB}dB:d={SILENCE_MIN_DUR}', '-f', 'null', '-'],
subprocess module call
Medium
- Category
- Dangerous Code Execution
- Confidence
- 70% confidence
- Finding
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
- Content
python me = re.search(r'silence_end: ([\d.]+)', line) if me: silence_ends.append(float(me.group(1))) dur_res = subprocess.run( ['ffprobe', '-v', 'quiet', '-show_entries', 'format=duration', '-of', 'json', str(wav)], capture_output=True, text=True )
subprocess module call
Medium
- Category
- Dangerous Code Execution
- Confidence
- 70% confidence
- Finding
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
- Content
python try: for idx, (seg_s, seg_e) in enumerate(non_silent): chunk = tmpdir / f"chunk_{idx:04d}.wav" subprocess.run(['ffmpeg', '-y', '-i', str(wav), '-ss', str(seg_s), '-to', str(seg_e), '-ar', '16000', '-ac', '1', str(chunk)], capture_output=True) r = mlx_whisper.transcribe(str(chunk), path_or_hf_repo=WHISPER_MODEL, language=WHISPER_LANG, condition_on_previous_text=False) for seg in r['segments']: seg['start'] += seg_s; seg['end'] += seg_s
Static analysis
No suspicious patterns detected.