Argmax Transcription and TTS

• Outcome: Review
• Latest audit: Sep 11, 2026 · 4:25 AM UTC
• Version: 1.0.1

Overview

The skill is mostly a coherent local speech tool, but its instructions include unsafe shell examples that could expose users to command injection or temporary-file tampering if followed literally.

Install only if you are comfortable with a Homebrew CLI that downloads ML models on first use and can optionally start a localhost API server. Agents should not follow the shell-template example literally; they should pass text through an argument-array process API or a securely created text file, and should use private temporary directories instead of fixed `/tmp` filenames.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:104
• Finding: Predictable Shared Temporary-File Paths<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 104–105 **Vulnerability Type**: Predictable temporary-file usage **Risk Level**: Medium ### Vulnerable Code ```bash whisperkit-cli tts --text-file /tmp/llm-response.txt \ --output-path /tmp/voice-reply.m4a ``` The same insecure pattern also appears throughout `SKILL.md` at lines 56, 65, 68, 73, 90, 95, 101, 108, and 137–143. ### Technical Analysis The skill recommends fixed, predictable filenames in the globally shared `/tmp` directory for input and output. In multi-user or adversarial local environments, another process may pre-create these paths, substitute attacker-controlled files, or create symbolic links before the agent accesses them. The actual behavior depends on how `whisperkit-cli` opens files and on operating-system permissions. Nevertheless, the documented workflow does not require exclusive creation, verify file ownership, reject symbolic links, or isolate files in a private temporary directory. This creates opportunities for local race conditions, unauthorized reads, content replacement, and redirected writes. ### Attack Path 1. A local attacker predicts a documented path such as `/tmp/llm-response.txt` or `/tmp/voice-reply.m4a`. 2. Before the agent runs the command, the attacker creates that path as a file or symbolic link, or repeatedly replaces it in a race. 3. The agent invokes `whisperkit-cli` using the predictable path. 4. The CLI may read attacker-controlled text, overwrite an unintended writable target, or place generated audio where the attacker can retrieve or alter it. 5. Subsequent processing or attachment of the output may disclose or propagate manipulated content. ### Impact Assessment Exploitation is limited to the permissions of the account running the agent and generally requires local filesystem access. A successful attack could: - Disclose generated speech or source text. - Replace input with attacker-controlled content. - Tamper with audio subs ...[truncated 273 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Create a private temporary directory for every operation, for example with `mktemp -d`. - Set owner-only permissions, such as mode `0700` for the directory and `0600` for sensitive files. - Generate cryptographically unpredictable filenames instead of using fixed paths. - Open output files using exclusive-creation semantics and reject existing files. - Reject symbolic links or use platform APIs that prevent symlink following. - Verify ownership and file type before reading inputs or attaching outputs. - Remove temporary files and directories reliably after processing, including on errors or interruption. - Prefer a process API and securely opened file descriptors over shell-based temporary-file workflows. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:141
• Finding: Command Injection Risk Through Direct Shell Template Interpolation<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, line 141 **Vulnerability Type**: Shell command injection **Risk Level**: Medium ### Vulnerable Code ```bash whisperkit-cli tts --text "{{llm_response}}" --output-path /tmp/reply --speaker ryan ``` ### Technical Analysis The example places the `{{llm_response}}` template directly inside a shell command. If an agent or template engine substitutes the response before shell parsing, text containing a double quote can terminate the intended argument. Shell operators, command substitutions, redirections, or additional commands in the substituted value may then be interpreted by the shell. Wrapping a pre-rendered value in double quotes does not safely encode arbitrary shell input. Exploitability depends on the execution implementation: invocation through a process API with an argument array would avoid shell parsing, while textual substitution followed by execution through a shell would be vulnerable. Because LLM output can be influenced by untrusted user content, it must not be treated as trusted shell syntax. ### Attack Path 1. An attacker supplies content intended to influence the generated LLM response. 2. The resulting response contains quote-breaking shell syntax, such as a closing double quote followed by a command separator and an additional command. 3. The agent substitutes the response into `{{llm_response}}` as raw text. 4. The completed command is passed to a shell. 5. The shell parses the injected syntax as commands rather than as a single TTS text argument. 6. The injected command executes with the privileges and environment of the agent process. ### Impact Assessment If the documented pattern is implemented through textual shell execution, an attacker may execute arbitrary commands with the same privileges as the agent account. Potential consequences include: - Reading or modifying files accessible to the agent. - Exposing credentials or tokens available in files or environment ...[truncated 404 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Do not construct shell commands by interpolating LLM-generated or user-controlled text. - Invoke `whisperkit-cli` through a process-execution API using a fixed argument array, passing the response as one argument without a shell. - For long text, write the response to a securely created file in a private temporary directory and use `--text-file`. - If shell execution is unavoidable, apply a well-tested, platform-specific argument-escaping routine to every untrusted value; do not rely on surrounding double quotes. - Disable shell interpretation explicitly where supported. - Treat model output as untrusted data and validate command construction with adversarial inputs containing quotes, substitutions, separators, newlines, and redirections. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: The manifest and top-level description present the skill primarily as a local STT/TTS CLI, but later documentation exposes a localhost HTTP API server and audio translation capability. This widens the operational and attack surface beyond what an agent or reviewer may expect, potentially causing the skill to be enabled in contexts where opening a listening service or performing cross-language transformation would not have been approved.

Missing User Warnings

Low

• Confidence: 87% confidence
• Finding: The skill states that models are downloaded automatically on first run, but it does not give an explicit security warning that initial execution performs external network access and fetches artifacts from third-party infrastructure. In controlled or air-gapped environments, this can violate user expectations, egress restrictions, or supply-chain review requirements.

Static analysis

No suspicious patterns detected.