Skills
Navigate
skills/modbender/skill-library-mcp/parakeet-local-asr/Gen Agent Trust Hub

parakeet-local-asr

Fail

Audited by Gen Agent Trust Hub on Oct 18, 2026

Risk Level: HIGHEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONDATA_EXFILTRATION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The scripts/bootstrap.sh script clones a code repository from an unverified external source (https://github.com/rundax/parakeet-asr.git).
  • [REMOTE_CODE_EXECUTION]: The skill executes downloaded scripts without prior verification or sandboxing. Specifically:
  • scripts/bootstrap.sh executes ./setup.sh from the cloned repository.
  • scripts/start.sh executes ./start-parakeet.sh from the cloned repository.
  • [COMMAND_EXECUTION]: The skill uses multiple shell scripts (bootstrap.sh, start.sh, healthcheck.sh, smoke-test.sh) to perform operations, including downloading external content and executing child scripts.
  • [DATA_EXFILTRATION]: The scripts/smoke-test.sh script uses curl to upload the contents of a user-specified file to a network endpoint (http://localhost:9001/v1/audio/transcriptions). If an attacker can influence the file path provided to this script, it could be used to read and transmit sensitive local files to the transcription service.
Recommendations
  • AI detected serious security threats
Audit Metadata
Risk Level
HIGH
Analyzed
Oct 18, 2026, 08:41 AM