audio-transcribe

Pass

Audited by Gen Agent Trust Hub on Apr 17, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONDATA_EXFILTRATION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: Fetches transcription data from dynamically generated URLs provided by the Alibaba Cloud DashScope API. This is the intended behavior for retrieving asynchronous processing results.
  • [EXTERNAL_DOWNLOADS]: Downloads machine learning models for speaker diarization from HuggingFace's public repository. These models are necessary for the skill's primary function of speaker identification.
  • [DATA_EXFILTRATION]: Uploads user-provided audio files to Alibaba Cloud's DashScope service for ASR processing. This network operation targets a well-known cloud service and is consistent with the skill's stated purpose.
  • [COMMAND_EXECUTION]: Utilizes ffmpeg and ffprobe via subprocess calls to normalize audio files and extract duration metadata. The commands use argument lists rather than shell strings, which mitigates the risk of command injection.
  • [PROMPT_INJECTION]: The skill processes untrusted audio data and generates markdown transcripts. While it does not include explicit boundary markers to delimit the transcribed content, it acts as a passive utility and does not execute instructions contained within the processed audio data.
  • [SAFE]: The skill reads API keys from ~/.claude/.env. This is documented as a standard practice for managing credentials within the platform environment and avoids hardcoding secrets in the script itself.
Audit Metadata
Risk Level
SAFE
Analyzed
Apr 17, 2026, 09:08 AM