The Agent Skills Directory

[COMMAND_EXECUTION]: The skill makes extensive use of subprocess.run to interact with system utilities (ffmpeg, ffprobe), transcription engines (Whisper), and LLM CLI tools (Claude, GitHub Copilot). While the implementation avoids shell=True and passes arguments as lists to mitigate shell injection, the script passes large blocks of untrusted transcribed text as command-line arguments to gh copilot suggest, which could lead to command length limitations or unexpected behavior in the target CLI.
[INDIRECT_PROMPT_INJECTION]: The workflow involves transcribing audio recordings and interpolating the resulting text directly into prompts sent to a Large Language Model. There is no evidence of sanitization or filtering for the transcribed content. Malicious instructions embedded in audio (e.g., spoken commands to ignore instructions or output specific data) could influence the generated summary or action items.
Ingestion points: Audio files (MP3, WAV, M4A, etc.) provided as local paths or external URLs (in scripts/transcribe.py).
Boundary markers: The process_with_llm function uses a triple-dash (---) and labels to separate instructions from the transcript text.
Capability inventory: The skill has capabilities for file writing, system command execution via subprocess, and network communication via the integrated LLM CLI tools.
Sanitization: No sanitization or escaping is performed on the transcribed speech before it is sent to the LLM.
[DYNAMIC_EXECUTION]: The main processing script (scripts/transcribe.py) contains logic to dynamically install Python packages (rich, tqdm) using pip at runtime if they are not already available on the system. Additionally, the skill utilizes bash scripts that execute complex logic via Python heredocs.
[EXTERNAL_DOWNLOADS]: The skill facilitates the download of external dependencies and large machine learning models. The install-requirements.sh script installs Python packages and triggers the download of Whisper models (~74MB+) from public registries (PyPI and HuggingFace). These are well-known services, but the skill requires significant external data retrieval to function.

audio-transcriber