transcribe-video — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited transcribe-video (Agent Skill) and scored it 96/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 1 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 1 flagged
The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Transcribes any video/audio file locally using a bundled whisper.cpp service. No external project or cloud API. Returns word-level timestamps (needed for synced overlays/captions).
/produce-video.Everything is driven by the bundled runner — never ask the user to manage Docker:
node scripts/transcribe.mjs <path-to-video-or-audio> [--out <dir>] [--port 9111] [--language en] [--no-word-ts] [--task transcribe|translate]
node scripts/transcribe.mjs --stop # stop the warm containerThe runner:
transcribe-video-whisper image from assets/whisper-service/ if it is missing (first build is slow: it compiles whisper.cpp and bakes the ggml-base.en.bin model).transcribe-video-whisper container (host port 9111 → container 9001); reuses it if already running, docker starts it if stopped.GET /healthz to report ok./transcribe with word_ts=true.transcript.txt, transcript.srt, transcript.words.json to --out (default: the input file's directory), and prints a JSON result line to stdout.transcript.txt — plain text.transcript.srt — subtitle text.transcript.words.json — [{ "word", "start", "end" }], seconds, time-ordered. This is the sync source for overlays/captions.stdout result line (for programmatic callers like /produce-video):
{ "ok": true, "outDir": "...", "wordCount": 38, "segmentCount": 2, "files": { "txt": "transcript.txt", "srt": "transcript.srt", "words": "transcript.words.json" } }--restart unless-stopped) for warm reuse; stop with --stop.references/ for the Docker lifecycle, the API shape, and the vendoring provenance.~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.