assemblyai-transcribe

Pass

Audited by Gen Agent Trust Hub on Mar 29, 2026

Risk Level: SAFE
Full Analysis
  • [COMMAND_EXECUTION]: The skill uses uv run to execute the local Python script scripts/transcribe.py, which manages the transcription and speaker diarization process.
  • [EXTERNAL_DOWNLOADS]: The script declares a dependency on the httpx library and communicates with api.assemblyai.com, which is a well-known service domain for AssemblyAI.
  • [DATA_EXFILTRATION]: Audio files and URLs are uploaded to AssemblyAI's servers for processing. This behavior is documented and essential to the skill's primary functionality.
  • [PROMPT_INJECTION]: The skill processes transcription output derived from audio content, which constitutes a surface for indirect prompt injection.
  • Ingestion points: scripts/transcribe.py accepts audio from local file paths or external URLs.
  • Boundary markers: No specific delimiters or safety warnings are included in the formatted output transcripts.
  • Capability inventory: The script has file-system write capabilities via the --output command-line argument.
  • Sanitization: No sanitization is performed on the text content retrieved from the transcription service.
Audit Metadata
Risk Level
SAFE
Analyzed
Mar 29, 2026, 11:46 PM