transcribing-slack-audio
Pass
Audited by Gen Agent Trust Hub on Nov 6, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes system utilities (
ffmpeg,ffprobe, andwhisper-cli) via thesubprocess.runAPI inscripts/transcribe.pyto process audio files. These calls are implemented correctly using argument lists rather than shell strings, which effectively prevents command injection vulnerabilities from malicious filenames. - [INDIRECT_PROMPT_INJECTION]: The skill transcribes untrusted user-provided audio and feeds the resulting text into the agent's context, creating a potential surface for indirect prompt injection attacks.
- Ingestion points: The script
scripts/transcribe.pyreads and processes audio files located in the/tmp/workspace/.posthog/attachments/directory. - Boundary markers: The
SKILL.mdinstructions do not require the agent to use delimiters or protective wrappers (like XML tags) when handling the transcript, which increases the risk of the agent confusing transcribed speech with system instructions. - Capability inventory: The agent has permissions to execute shell commands and file operations; the transcription script itself has the capability to run media processing tools.
- Sanitization: The transcription process does not include filters or sanitization to detect or neutralize potential natural language instructions embedded within the audio content.
Audit Metadata