accurate-transcription
Pass
Audited by Gen Agent Trust Hub on Jun 22, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill's transcription script (
scripts/transcribe.py) utilizes thefunasrlibrary, which automatically downloads required pre-trained models (paraformer-zh, fsmn-vad, and ct-punc) from ModelScope. ModelScope is an established and well-known model repository provided by Alibaba. This download behavior is standard for the skill's primary function.\n- [PROMPT_INJECTION]: The skill implements a multi-agent workflow to reconcile and proofread transcription results, which involves processing external text data derived from ASR and OCR sources. This creates a surface for indirect prompt injection if the source audio, video, or visual material contains adversarial instructions.\n - Ingestion points:
scripts/transcribe.py(ASR output) andreferences/ground-truth.md(text extracted from images via OCR).\n - Boundary markers: The reconciliation prompts in
references/reconciliation.mdinclude specific behavioral constraints and instructions to be "extremely conservative" and avoid rewriting speaking content.\n - Capability inventory: The Python transcription script writes results to the local filesystem (
funasr_result.json), and the skill instructions suggest the use of shell commands forffmpegandwhisper-cpp.\n - Sanitization: No programmatic sanitization or filtering of transcribed text is performed before it is passed to the agent for reconciliation.
Audit Metadata