whisper-stt
Pass
Audited by Gen Agent Trust Hub on Apr 18, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill instructions include installing the
openai-whisperpackage from the Python Package Index andtorchfrom the official PyTorch registry. - [COMMAND_EXECUTION]: The skill uses the
whispercommand-line tool to perform local audio transcription. - [PROMPT_INJECTION]: The skill creates an indirect prompt injection surface by converting untrusted audio input into text that is then processed by the AI agent without sanitization. Ingestion points: Audio files are ingested and transcribed as shown in the workflow section of
SKILL.md. Boundary markers: The skill does not implement delimiters or instructions to ignore embedded commands within the transcribed text. Capability inventory: The agent has the capability to execute shell commands via thewhisperCLI and run Python code. Sanitization: No sanitization or validation of the transcribed text is performed before it is used in subsequent agent steps.
Audit Metadata