parakeet
Pass
Audited by Gen Agent Trust Hub on Oct 9, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONREMOTE_CODE_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill uses
uvx parakeet-mlxto fetch and execute the transcription package and downloads a large (~2.5GB) machine learning model from external repositories on its first run. - [COMMAND_EXECUTION]: Instructions include multiple shell commands for file manipulation and text processing, including
awk,grep,cat, andffmpegfor audio conversion. - [REMOTE_CODE_EXECUTION]: The use of
uvxallows for the dynamic download and execution of theparakeet-mlxPython package from external registries. - [INDIRECT_PROMPT_INJECTION]: The skill is designed to process untrusted audio content and convert it into text specifically for further LLM processing, which could allow malicious instructions embedded in audio to influence downstream tasks.
- Ingestion points:
srt_to_text.pyanduvx parakeet-mlxingest untrusted audio files and SRT data. - Boundary markers: None identified; the text extraction script joins segments into continuous prose without delimiters.
- Capability inventory: File system writes (
> transcript.txt), shell command execution, and recommended piping to LLM tools. - Sanitization: No sanitization or filtering of transcribed text is performed before output or LLM piping.
Audit Metadata