audio-transcribe
Pass
Audited by Gen Agent Trust Hub on Apr 17, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONDATA_EXFILTRATION
Full Analysis
- [EXTERNAL_DOWNLOADS]: Fetches transcription data from dynamically generated URLs provided by the Alibaba Cloud DashScope API. This is the intended behavior for retrieving asynchronous processing results.
- [EXTERNAL_DOWNLOADS]: Downloads machine learning models for speaker diarization from HuggingFace's public repository. These models are necessary for the skill's primary function of speaker identification.
- [DATA_EXFILTRATION]: Uploads user-provided audio files to Alibaba Cloud's DashScope service for ASR processing. This network operation targets a well-known cloud service and is consistent with the skill's stated purpose.
- [COMMAND_EXECUTION]: Utilizes
ffmpegandffprobevia subprocess calls to normalize audio files and extract duration metadata. The commands use argument lists rather than shell strings, which mitigates the risk of command injection. - [PROMPT_INJECTION]: The skill processes untrusted audio data and generates markdown transcripts. While it does not include explicit boundary markers to delimit the transcribed content, it acts as a passive utility and does not execute instructions contained within the processed audio data.
- [SAFE]: The skill reads API keys from
~/.claude/.env. This is documented as a standard practice for managing credentials within the platform environment and avoids hardcoding secrets in the script itself.
Audit Metadata