use-local-whisper
Fail
Audited by Gen Agent Trust Hub on Jun 19, 2026
Risk Level: HIGHREMOTE_CODE_EXECUTIONEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [REMOTE_CODE_EXECUTION]: The skill instructs the agent to fetch and merge code from a third-party GitHub repository (https://github.com/qwibitai/pepper-whatsapp.git). This results in the integration and execution of unverified external code into the agent's local environment through source code merging and subsequent builds.
- [EXTERNAL_DOWNLOADS]: Fetches a machine learning model file (ggml-base.bin) from Hugging Face. While Hugging Face is a well-known service and the download itself is documented neutrally, the skill relies on this external binary data for its primary function.
- [COMMAND_EXECUTION]: The skill performs modifications to system service definitions (com.pepper.plist) and manages service lifecycle states using launchctl. It specifically alters the system PATH environment variable within the service configuration to include Homebrew binary directories, representing a persistent system modification.
Recommendations
- AI detected serious security threats
Audit Metadata