transcribe

Pass

Audited by Gen Agent Trust Hub on May 17, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill executes multiple commands via the voxflow CLI and ffmpeg to process audio and video files, including asr, dub, and video-translate.
  • [EXTERNAL_DOWNLOADS]: The skill fetches remote media content for processing when the --url flag is used with the asr command. It also requires the installation of the voxflow package from the npm registry.
  • [PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it processes untrusted user data (audio, video, and SRT files) through LLM-based translation and summarization services.
  • Ingestion points: User-provided files and remote URLs processed by asr, translate, video-translate, and summarize commands in SKILL.md.
  • Boundary markers: No explicit delimiters or instructions are used to separate untrusted content from the system prompts during processing.
  • Capability inventory: The skill possesses file system access (read/write), network communication capabilities (API, Cloudflare R2, and webhooks), and external command execution.
  • Sanitization: There is no evidence of specific sanitization or filtering of the content before it is sent to the language models.
Audit Metadata
Risk Level
SAFE
Analyzed
May 17, 2026, 11:49 PM
Security Audit — agent-trust-hub — transcribe