skills/zjunlp/skills/openai-whisper/Gen Agent Trust Hub

openai-whisper

Pass

Audited by Gen Agent Trust Hub on Jun 24, 2026

Risk Level: SAFE
Full Analysis
  • [COMMAND_EXECUTION]: The transcribe.sh script uses standard shell commands like curl and mkdir to interface with the OpenAI API and manage local output files. All variables are correctly quoted to prevent shell injection.- [EXTERNAL_DOWNLOADS]: The skill references the official OpenAI Whisper formula for installation via Homebrew, which is a well-known and trusted package management service.- [DATA_EXFILTRATION]: Audio data is transmitted to OpenAI's official API endpoint (api.openai.com) for transcription. This behavior is consistent with the stated purpose of the skill and targets a well-known service.- [CREDENTIALS_UNSAFE]: Documentation regarding the OPENAI_API_KEY follows secure practices by instructing users to use environment variables or local configuration files instead of hardcoding secrets.
Audit Metadata
Risk Level
SAFE
Analyzed
Jun 24, 2026, 11:39 AM
Security Audit — agent-trust-hub — openai-whisper