audio-transcriber
Pass
Audited by Gen Agent Trust Hub on Mar 7, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONREMOTE_CODE_EXECUTIONPROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill automates the installation of required Python packages (faster-whisper, tqdm, rich) and system binaries (ffmpeg) using official package managers like pip and Homebrew. It also facilitates the download of pre-trained Whisper models from verified repositories such as Hugging Face.
- [COMMAND_EXECUTION]: The skill uses the subprocess module to invoke necessary system utilities including ffmpeg and ffprobe for audio validation and format conversion. These operations are essential for the skill's primary function and are implemented using best practices for shell execution.
- [REMOTE_CODE_EXECUTION]: The skill interacts with remote AI services by invoking the official Claude CLI and GitHub Copilot CLI for processing transcripts. These tools are provided by trusted vendors (Anthropic and Microsoft/GitHub) and are used exclusively for text summarization and document generation.
- [PROMPT_INJECTION]: The skill processes untrusted audio content, which presents a surface for indirect prompt injection. Ingestion points: Transcripts of user-provided audio files are processed by the transcribe.py script. Boundary markers: The skill uses Markdown headers and delimiters (e.g., '---') to separate content. Capability inventory: Subprocess execution of audio tools and AI CLIs, and local file system write access. Sanitization: The skill relies on structured prompt templates and boundary markers rather than explicit content filtering.
Audit Metadata