audio-transcription

Pass

Audited by Gen Agent Trust Hub on Oct 11, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONDATA_EXFILTRATIONPERSISTENCE
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill downloads specific AI model weights from Hugging Face and Python dependencies from official registries and verified GitHub repositories. These downloads are performed only during an explicit setup workflow and use pinned revisions to ensure integrity.
  • [DATA_EXFILTRATION]: In its cloud-based transcription mode, the skill converts local media to MP3 and uploads it to the Doubao/Volcengine OpenSpeech API. This behavior is documented, intended for the skill's primary purpose, and requires the user to pass a specific consent flag (--online-consent) to execute. Local transcription paths are strictly offline.
  • [COMMAND_EXECUTION]: The skill makes extensive use of subprocess calls to execute well-known media processing tools like ffmpeg and ffprobe, as well as the uv package manager and internal Python scripts. All command arguments are handled securely to prevent shell injection.
  • [PERSISTENCE]: The skill includes a feature to install a launcher script in a user-chosen bin directory. This facilitates stable CLI access but is entirely optional and requires explicit user interaction to select the installation path.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 11, 2026, 12:01 AM