audio-transcribe

Pass

Audited by Gen Agent Trust Hub on Sep 22, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill uses npx to execute the agent-media package for transcription and video processing tasks.
  • [EXTERNAL_DOWNLOADS]: The skill fetches the agent-media package from the NPM registry via npx. Additionally, the local processing mode downloads models from Hugging Face on its first run.
  • [INDIRECT_PROMPT_INJECTION]: The skill processes potentially untrusted audio data from local files or remote URLs. It manages this risk by returning the transcription in a structured JSON format containing specific text segments.
  • Ingestion points: Audio and video files provided to the --in parameter in SKILL.md.
  • Boundary markers: Output is structured as a JSON object with clearly defined keys for metadata and transcription segments.
  • Capability inventory: The skill utilizes file system access for local media, network access for remote media and API providers, and command execution via npx.
  • Sanitization: Relies on the transcription models (e.g., Whisper, Moonshine) to process speech into text without interpreting it as commands.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 22, 2026, 02:49 PM