asr-transcribe-to-text

Warn

Audited by Gen Agent Trust Hub on Oct 24, 2026

Risk Level: MEDIUMCOMMAND_EXECUTIONEXTERNAL_DOWNLOADSDYNAMIC_EXECUTIONDATA_EXFILTRATION
Full Analysis
  • [DYNAMIC_EXECUTION]: The script scripts/build_whispercpp_gpu.py downloads a specific commit of the whisper.cpp source code from its official repository and performs runtime compilation using cmake. This is used to build a Metal-optimized binary for Apple Silicon.
  • [COMMAND_EXECUTION]: Multiple Python scripts (scripts/prepare_asr_input.py, scripts/resolve_media_input.py, scripts/measure_asr.py, etc.) make extensive use of subprocess.run and subprocess.Popen to execute system commands including ffmpeg, ffprobe, curl, and cmake.
  • [EXTERNAL_DOWNLOADS]: scripts/resolve_media_input.py is designed to extract media URLs from web pages and download them to the local system. Additionally, several scripts download machine learning models from well-known hubs like HuggingFace and ModelScope during initialization.
  • [DATA_EXFILTRATION]: scripts/transcribe_remote.py sends audio data to a remote ASR endpoint via curl. While this is a primary feature for users without local GPU support, it involves sending potentially sensitive audio data to external servers configured in the skill's settings.
  • [DYNAMIC_EXECUTION]: scripts/review-workbench/server.py implements a local HTTP server using the standard library. It serves static assets and provides API endpoints to read and write review state and audio fragments. The server includes basic local-request validation but increases the overall attack surface of the skill.
Audit Metadata
Risk Level
MEDIUM
Analyzed
Oct 24, 2026, 11:19 PM