whisper-extract — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited whisper-extract (Agent Skill) and scored it 92/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 2 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 2 flagged
The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Transcribe audio or video with Whisper, then produce a .md file containing an AI summary followed by the complete literal transcript.
Before doing anything else, verify that Whisper is installed:
whisper --help > /dev/null 2>&1 && echo "OK" || echo "NOT FOUND"If not found, tell the user to run:
pipx install openai-whisper
brew install ffmpeg # if ffmpeg is missingThen stop and wait — do not proceed until Whisper is available.
Ask the following in a single message if the user has not already provided them. Never ask more than once, and never ask for things already mentioned in the conversation.
Required:
Spanish, English, Portuguese. If unsure, say "auto-detect" and Whisper will figure it out (slower).Optional (ask only if not obvious):
medium. Options: tiny (fastest, less accurate), base, small, medium (recommended balance), large-v3 (most accurate, ~3 GB download). Ask if the user cares about speed vs. accuracy..md file. Default: same directory as the audio file.Wait for the user's answers before proceeding to Step 2.
Run Whisper on the provided file. Use the --output_format json flag to capture word-level timing and text cleanly, and --output_dir to control where the raw output goes.
whisper "<file_path>" --model <model> --language <language_code_or_auto> --output_format json --output_dir /tmp/whisper-extract-tempImportant: Always emit this as a single line — never split with\continuations. A trailing space after\is not a line continuation in zsh; it becomes an escaped space that Whisper receives as a second (empty) file path, causing ffmpeg to fail withError opening input file .
Language codes: es for Spanish, en for English, pt for Portuguese, fr for French, etc. For auto-detect, omit --language entirely.
If the file is large (> 1 hour): Whisper will take several minutes. Tell the user:
"Starting transcription — this may take a few minutes depending on file length and model."
After the command completes, read the JSON output from /tmp/whisper-extract-temp/ and extract the text field. This is the full raw transcript.
If Whisper fails (file not found, unsupported format, ffmpeg missing), report the exact error and suggest a fix before continuing.
Given the full transcript text and the recording context provided by the user, produce a structured summary. Write it in the output language chosen in Step 1.
The summary must cover:
a lecture or monologue with no decisions).
conversation (optional but highly recommended for interviews and meetings).
Keep the summary concise: aim for 150-300 words. Do not pad it.
Construct and save the output Markdown file.
Use this pattern: YYYY-MM-DD-<slugified-context>.md
Examples:
2026-04-14-team-meeting-q3-roadmap.md2026-04-14-candidate-interview-backend.md2026-04-14-lecture-clean-architecture.mdIf today's date is available in context, use it. Otherwise, use the file's modification date via stat or just omit the date prefix and use the slugified context alone.
Use this exact template:
---
title: "<recording context>"
date: YYYY-MM-DD
model: <whisper model used>
language: <detected or specified language>
source: "<original filename>"
duration: "<approximate duration if available>"
---
# <Descriptive title based on context>
## Summary
<The summary generated in Step 3>
---
## Full Transcript
<The complete literal transcript from Whisper, paragraph-formatted>Transcript formatting rules:
10-15 sentences. This makes the file easier to navigate without altering the content.
Save the file to the chosen output directory with Write.
After saving, show the user:
.md file.Transcript: ~N words.Do not dump the entire transcript in the chat — it's in the file. If the user wants to search or quote from the transcript, they can open the file.
| Problem | Action |
|---|---|
whisper: command not found | Tell user to run pipx install openai-whisper |
ffmpeg not found | Tell user to run brew install ffmpeg |
| File not found | Ask user to confirm the path; suggest ls to check |
| Unsupported format | Tell user to convert with ffmpeg -i input.xyz output.mp3 |
| Transcription empty / very short | Warn user — likely a silent file or wrong path |
| Out of memory (large model) | Suggest downgrading to medium or small |
Write the summary in the same language as the recording (or the output language if specified). Be concise and factual — the summary serves as a quick reference, not a narrative essay. The transcript is the source of truth; the summary is the lens.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.