local-whisper-hardened
Pass
Audited by Gen Agent Trust Hub on Apr 21, 2026
Risk Level: SAFEPROMPT_INJECTIONEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONDATA_EXFILTRATION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill fetches the PyTorch library and its associated dependencies from the official PyTorch CPU index (download.pytorch.org) during the setup process. This is a well-known and expected source for this technology.
- [COMMAND_EXECUTION]: The skill requires the execution of a local Python script (
scripts/transcribe.py) and system binaries likeffmpegto perform audio processing. The usage involves standard CLI commands for managing local environments and dependencies. - [PROMPT_INJECTION]: The skill contains extensive "Safety Evaluation" documentation in
SAFETY.mdandSKILL.md. This documentation includes adversarial examples, such as malicious shell commands and suspicious URLs, intended to train the agent to refuse attacks. However, these strings reside within the skill's data and present a surface for indirect prompt injection if the agent's context boundaries fail to distinguish between descriptive documentation and active instructions. - [DATA_EXFILTRATION]: As a transcription tool, the skill processes potentially sensitive audio content. The documentation explicitly identifies the risk of exfiltrating this data via network commands and includes proactive guardrails instructing the agent to never transmit transcription results to external endpoints.
- [PROMPT_INJECTION]: This skill has an inherent indirect prompt injection surface due to its core function of processing untrusted audio data.
- Ingestion points: The
audio_fileargument inscripts/transcribe.pyis transcribed into text that enters the agent's context. - Boundary markers: Absent. The script outputs raw transcribed text without delimiters or instructions to ignore embedded commands.
- Capability inventory: The skill environment allows for subprocess execution, file system access, and network operations, which could be targeted by commands embedded in audio.
- Sanitization: None. The transcription output is printed directly to the shell or JSON output without filtering for potentially executable or adversarial content.
Audit Metadata