audio-scribe — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited audio-scribe (Agent Skill) and scored it 96/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 1 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 1 flagged
The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Speech-to-text with three swappable backends and one specialised endpoint for multi-track Audacity / Craig recordings. All endpoints accept a multipart file upload and return a Markdown transcript.
Use whatever base URL the runtime gives you for AudioScribe; examples below use $BASE. Ask if it isn't configured.
All under /api/v1/transcribe. Each takes a file form field plus a few optional form fields. By default the response is the transcript file itself (Markdown). Set stream=true to get an SSE progress stream that ends with a download_url you can fetch from /api/v1/transcribe/download/{file_id}.
POST /local: local faster-whisper on the host GPU. Best when the file is sensitive (no third-party API), GPU isavailable, or you want timestamps. Form fields: file, model (default Systran/faster-whisper-large-v3), language (auto if omitted), with_timestamps (default false), stream.
POST /openai: OpenAI Whisper API. Best for short clips when you want the highest-quality general-purpose result anddon't need timestamps. Server handles chunking for files >25MB. Form fields: file, model (default whisper-1), language, stream.
POST /hf: Hugging Face Inference. Use when the user names a specific HF model or you want to avoid OpenAI. Formfields: file, model (default openai/whisper-large-v3), hf_provider (default hf-inference), stream.
POST /audacity: multi-track .zip (Audacity .aup project, or a Craig Bot dump). Extracts each track, transcribesthem with whichever backend you pick, and merges chronologically into [HH:MM:SS] [Speaker] … lines. Form fields: file (must be .zip), provider (local / openai / hf, default local), model, language, hf_provider, stream.
Default to local when the host has a GPU, it's free, private, and supports timestamps. Switch to openai for short clips where quality matters and the recording is non-sensitive. Use hf only when the user pins a specific HF model. For multi-speaker or Discord/Craig recordings always use /audacity.
Quick transcription with the local model (response is the .md file), Bash:
curl -s -o transcript.md \
-X POST $BASE/api/v1/transcribe/local \
-F "[email protected]" \
-F "with_timestamps=true"PowerShell:
curl.exe -s -o transcript.md `
-X POST $BASE/api/v1/transcribe/local `
-F "[email protected]" `
-F "with_timestamps=true"OpenAI backend, English forced, Bash:
curl -s -o transcript.md \
-X POST $BASE/api/v1/transcribe/openai \
-F "[email protected]" \
-F "language=en"PowerShell:
curl.exe -s -o transcript.md `
-X POST $BASE/api/v1/transcribe/openai `
-F "[email protected]" `
-F "language=en"Audacity / Craig multi-track zip with chronological speaker merge, Bash:
curl -s -o transcript.md \
-X POST $BASE/api/v1/transcribe/audacity \
-F "[email protected]" \
-F "provider=local"PowerShell:
curl.exe -s -o transcript.md `
-X POST $BASE/api/v1/transcribe/audacity `
-F "[email protected]" `
-F "provider=local"Streaming progress (SSE) for a long file, Bash:
curl -N -X POST $BASE/api/v1/transcribe/local \
-F "[email protected]" \
-F "stream=true"PowerShell:
curl.exe -N -X POST $BASE/api/v1/transcribe/local `
-F "[email protected]" `
-F "stream=true"The stream emits {"type":"progress",…} events and ends with {"type":"complete","download_url":"/api/v1/transcribe/download/<id>"}. Fetch the URL from $BASE to get the Markdown.
Note for PowerShell: line continuation is the backtick ` `, not \. Use curl.exe so PowerShell doesn't route to its Invoke-WebRequest` alias.
stream=true so the user sees progress instead of staring at a hung request.
language when you know it; auto-detection wastes the first chunk on identification.you have it.
OPENAI_API_KEY / HF_TOKEN are configured server-side: don't ask the user for keys.~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.