audio-transcriber
Pass
Audited by Gen Agent Trust Hub on Mar 29, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes system commands via Python's subprocess module to perform transcription, convert audio formats using ffmpeg, and invoke AI CLI tools (Claude or GH Copilot) for summarization. These calls are essential to the skill's core functionality and do not utilize unsafe shell execution.
- [EXTERNAL_DOWNLOADS]: During initialization, the skill downloads pre-trained transcription models from OpenAI or HuggingFace and installs necessary Python packages (faster-whisper, rich, tqdm) from PyPI. These operations are conducted using standard, official package managers and repositories.
- [PROMPT_INJECTION]: The skill processes untrusted audio recordings that are subsequently summarized by an LLM, representing a surface for indirect prompt injection where spoken instructions could attempt to manipulate the generated summary. (Ingestion points: Audio files transcribed in scripts/transcribe.py. Boundary markers: Prompt templates use triple-dash delimiters and explicit headers to separate instructions from data. Capability inventory: Limited to file system writes for Markdown output and network access via authorized AI CLI tools. Sanitization: The skill does not sanitize transcribed text before passing it to the LLM).
Audit Metadata