voice-to-text

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.65). Outsider-authored free text can reach the agent’s LLM context via the runtime transcription output: the required workflow ingests the user-provided audio content (e.g., “voice messages … from WeChat/Telegram/WhatsApp”), and transcribe.py outputs the recognized speech text (printed to stdout) which then becomes readable text the surrounding system can forward into the LLM; audio is not authored by the operating user, so this is indirect prompt-injection exposure.