openai-whisper-api
Pass
Audited by Gen Agent Trust Hub on Apr 28, 2026
Risk Level: SAFE
Full Analysis
- [COMMAND_EXECUTION]: The skill utilizes a bash script (
scripts/transcribe.sh) to executecurlcommands for interacting with the OpenAI API.\n- [DATA_EXFILTRATION]: Transmits audio files to OpenAI's official API endpoint (api.openai.com) for transcription. This is the intended purpose of the skill and targets a well-known service.\n- [PROMPT_INJECTION]: The skill processes external audio content, creating an indirect prompt injection surface when the resulting transcript is read by the agent.\n - Ingestion points: The transcript produced by the OpenAI API is saved to a local file (specified by
--outor defaulting to<input>.txt/json).\n - Boundary markers: Absent; the transcript is written directly to the file without delimiters or warnings.\n
- Capability inventory: The script performs file system writes and network operations via
curl.\n - Sanitization: No sanitization is performed on the transcript output before it is written to the file.
Audit Metadata