whisper

Warn

Audited by Socket on Sep 22, 2026

1 alert found:

Security
SecurityMEDIUM
SKILL.md

SUSPICIOUS: the skill's actual behavior is a Pixazo gateway integration for speech-to-text, but its stated purpose repeatedly claims image generation/editing via OpenAI Whisper, which is materially false. Credential collection/storage is proportionate to an API integration, yet the key is routed to a third-party gateway rather than OpenAI, and the wildcard transitive skill-install instruction adds unnecessary trust expansion.

Confidence: 92%Severity: 71%
Audit Metadata
Analyzed At
Sep 22, 2026, 09:04 PM
Package URL
pkg:socket/skills-sh/pixazo-ai%2Fskills%2Fwhisper%2F@a2d47b693fd68bf7b0909a625cc8ff484046180a6d30eefe7e29a7eccbb65af9