audio-transcribe
Pass
Audited by Gen Agent Trust Hub on Sep 22, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill uses
npxto execute theagent-mediapackage for transcription and video processing tasks. - [EXTERNAL_DOWNLOADS]: The skill fetches the
agent-mediapackage from the NPM registry vianpx. Additionally, the local processing mode downloads models from Hugging Face on its first run. - [INDIRECT_PROMPT_INJECTION]: The skill processes potentially untrusted audio data from local files or remote URLs. It manages this risk by returning the transcription in a structured JSON format containing specific text segments.
- Ingestion points: Audio and video files provided to the
--inparameter inSKILL.md. - Boundary markers: Output is structured as a JSON object with clearly defined keys for metadata and transcription segments.
- Capability inventory: The skill utilizes file system access for local media, network access for remote media and API providers, and command execution via
npx. - Sanitization: Relies on the transcription models (e.g., Whisper, Moonshine) to process speech into text without interpreting it as commands.
Audit Metadata