skills/ooiyeefei/ccc/scribe/Gen Agent Trust Hub

scribe

Pass

Audited by Gen Agent Trust Hub on Aug 9, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSDATA_EXFILTRATIONPROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill invokes the ffprobe command-line tool in scripts/transcribe.py to retrieve metadata from audio files. This is implemented using a secure argument list to prevent shell injection vulnerabilities.
  • [EXTERNAL_DOWNLOADS]: The skill facilitates transcription by connecting to established services like ElevenLabs, Deepgram, and OpenAI. These network operations are core to its functionality and are clearly documented.
  • [DATA_EXFILTRATION]: Audio recordings are uploaded to the selected transcription provider. To address privacy concerns, the skill includes a local provider option that keeps all data on the host machine using the faster-whisper library.
  • [PROMPT_INJECTION]: The skill processes untrusted transcription results and implements auditing logic to mitigate risks from inaccurate or misleading model output.
  • Ingestion points: Audio recordings in scripts/transcribe.py and JSON transcript files in scripts/audit.py.
  • Boundary markers: Low-confidence text is wrapped in <?...?> markers to highlight potential errors.
  • Capability inventory: Includes API requests to STT services, local file manipulation, and metadata extraction via ffprobe.
  • Sanitization: Structural validation of transcript JSON and entity-based filtering to identify risky content for user review.
Audit Metadata
Risk Level
SAFE
Analyzed
Aug 9, 2026, 11:45 AM
Security Audit — agent-trust-hub — scribe