stepfun-asr

Pass

Audited by Gen Agent Trust Hub on Sep 24, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill contains a utility script scripts/check_params.py that fetches documentation from stepfun.mintlify.app. This is used to programmatically verify that the transcription script supports all current API parameters and does not involve the execution of remote code.
  • [COMMAND_EXECUTION]: The skill provides functional Python scripts (asr_transcribe.py and asr_file.py) designed to be executed via the command line. These scripts perform necessary operations such as reading local audio files, base64 encoding data, and making network requests to the StepFun API.
  • [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted audio input from local files or remote URLs to produce text transcripts. While there is a theoretical risk of malicious audio content influencing the output text, the skill only returns the text and does not direct it into any exploitable capabilities.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 24, 2026, 03:05 AM