whisper-transcribe
Pass
Audited by Gen Agent Trust Hub on Jun 12, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill relies on the execution of the whisper-transcribe shell command to perform its primary function of transcribing media files.
- [EXTERNAL_DOWNLOADS]: The skill downloads machine learning models from the Hugging Face Hub (huggingface.co) upon its first use. These downloads are from a well-known service and are necessary for the skill's operation.
- [COMMAND_EXECUTION]: Installation documentation suggests running shell commands for environment setup, including pip install and chmod.
- [PROMPT_INJECTION]: The skill possesses a surface for indirect prompt injection as it transcribes untrusted media content into text that is subsequently processed by the agent.
- Ingestion points: Audio and video files (SKILL.md)
- Boundary markers: None identified for the transcription output
- Capability inventory: System command execution via subprocess calls (SKILL.md)
- Sanitization: No explicit sanitization of transcribed content is provided
Audit Metadata