The Agent Skills Directory

[COMMAND_EXECUTION]: The script scripts/transcribe.sh performs unsafe shell expansion when invoking curl. Specifically, variables expanded using the ${var:+...} syntax (such as for --language and --prompt) are not double-quoted. This leads to word splitting, which an attacker can exploit by providing an argument containing spaces to inject additional flags into the curl command.
[DATA_EXFILTRATION]: Due to the argument injection vulnerability in the curl command, an attacker can use the -F "key=@file" syntax to read and exfiltrate sensitive files from the local filesystem (such as .env files or SSH keys) by sending them to the API endpoint or an injected malicious destination.

openai-whisper-api