recording-transcription

Pass

Audited by Gen Agent Trust Hub on Aug 10, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The script scripts/transcribe.py invokes ffmpeg and ffprobe via subprocess.run() to handle audio normalization, duration detection, and splitting. These calls use argument lists rather than shell strings, which follows security best practices to prevent shell injection.
  • [EXTERNAL_DOWNLOADS]: The skill requires the installation of third-party Python packages (faster-whisper, opencc-python-reimplemented, httpx[socks]) from official repositories. It also performs a connectivity check to huggingface.co to determine if model weights can be downloaded.
  • [PROMPT_INJECTION]: The skill processes untrusted data (external audio files and user-supplied transcription drafts), creating a surface for indirect prompt injection. The instructions include mitigation strategies, such as using subagents for processing large transcripts and instructing the AI to use specific markers like [不確定] for ambiguous content rather than hallucinating text.
Audit Metadata
Risk Level
SAFE
Analyzed
Aug 10, 2026, 09:48 AM
Security Audit — agent-trust-hub — recording-transcription