asr-transcribe-to-text
Warn
Audited by Gen Agent Trust Hub on Oct 24, 2026
Risk Level: MEDIUMCOMMAND_EXECUTIONEXTERNAL_DOWNLOADSDYNAMIC_EXECUTIONDATA_EXFILTRATION
Full Analysis
- [DYNAMIC_EXECUTION]: The script
scripts/build_whispercpp_gpu.pydownloads a specific commit of thewhisper.cppsource code from its official repository and performs runtime compilation usingcmake. This is used to build a Metal-optimized binary for Apple Silicon. - [COMMAND_EXECUTION]: Multiple Python scripts (
scripts/prepare_asr_input.py,scripts/resolve_media_input.py,scripts/measure_asr.py, etc.) make extensive use ofsubprocess.runandsubprocess.Popento execute system commands includingffmpeg,ffprobe,curl, andcmake. - [EXTERNAL_DOWNLOADS]:
scripts/resolve_media_input.pyis designed to extract media URLs from web pages and download them to the local system. Additionally, several scripts download machine learning models from well-known hubs like HuggingFace and ModelScope during initialization. - [DATA_EXFILTRATION]:
scripts/transcribe_remote.pysends audio data to a remote ASR endpoint viacurl. While this is a primary feature for users without local GPU support, it involves sending potentially sensitive audio data to external servers configured in the skill's settings. - [DYNAMIC_EXECUTION]:
scripts/review-workbench/server.pyimplements a local HTTP server using the standard library. It serves static assets and provides API endpoints to read and write review state and audio fragments. The server includes basic local-request validation but increases the overall attack surface of the skill.
Audit Metadata