file-transcribe

No clear evidence of malware, backdoors, or supply-chain sabotage is present in this module. The dominant security concerns are operational/intentional but sensitive: it reads a local JWT secret and transmits it to a remote proxy, it sends user-provided audio URLs for transcription, it logs transcript previews that may contain sensitive content, and it executes ffprobe/ffmpeg on untrusted media paths (expanding the trust boundary to external binaries). Overall, this looks like a legitimate transcription utility with moderate security risk driven by credential handling, PII exposure in logs, and reliance on ffmpeg/ffprobe for untrusted inputs.

SUSPICIOUS. The capability mostly matches the stated purpose, and the local tooling footprint is modest, but the core data flow sends user media through an OpenKBS proxy/preview server rather than a clearly documented official Whisper endpoint. That proxy design is proportionate to transcription but insufficiently transparent, creating medium risk around data handling and trust.