openai-whisper-api
Pass
Audited by Gen Agent Trust Hub on Jul 9, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill uses a bash script to execute
curlcommands for interacting with the OpenAI API. This is the intended behavior for audio transcription tasks. - [EXTERNAL_DOWNLOADS]: The script communicates with OpenAI's official API endpoint (
api.openai.com) to send audio files and receive transcriptions. OpenAI is recognized as a well-known service provider. - [PROMPT_INJECTION]: The skill processes external audio data which constitutes a surface for indirect prompt injection. Ingestion points: Audio files provided as arguments to
scripts/transcribe.sh. Boundary markers: Not used in the transcription output. Capability inventory: The script performs file reads/writes and network requests viacurl. Sanitization: The resulting transcription is written directly to an output file without further validation or filtering.
Audit Metadata