stepfun-asr
Pass
Audited by Gen Agent Trust Hub on Sep 24, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill contains a utility script
scripts/check_params.pythat fetches documentation fromstepfun.mintlify.app. This is used to programmatically verify that the transcription script supports all current API parameters and does not involve the execution of remote code. - [COMMAND_EXECUTION]: The skill provides functional Python scripts (
asr_transcribe.pyandasr_file.py) designed to be executed via the command line. These scripts perform necessary operations such as reading local audio files, base64 encoding data, and making network requests to the StepFun API. - [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted audio input from local files or remote URLs to produce text transcripts. While there is a theoretical risk of malicious audio content influencing the output text, the skill only returns the text and does not direct it into any exploitable capabilities.
Audit Metadata