Security risk report for @forgecat/openai_skills_transcribe v0.0.11
Source Integrity
Low
Profile is sourced from OpenAI's official public repository (github.com/openai/skills) with a specific commit hash and Apache-2.0 license.
Metadata (author, repository, commit, license) is transparent and verifiable.
Agent Intent
Low
Content describes a legitimate audio transcription workflow with no instructions to manipulate the AI, ignore system prompts, or exfiltrate data.
References to OPENAI_API_KEY are for normal API authentication, not credential harvesting or leakage.
No guidance poisoning: dependencies (openai library) are legitimate and well-known; no typosquatted packages or security-weakening defaults are introduced.
Details
Evidence
Verify OPENAI_API_KEY is set. If missing, ask the user to set it locally (do not ask them to paste the key).
Never ask the user to paste the full key in chat.
uv pip install openai
Permissions
Low
No tools or hooks are declared in the profile; the skill is a documentation/workflow guide for using OpenAI's transcription API.
File operations are scoped to output directories (output/transcribe/) and user-provided audio paths, matching the stated transcription purpose.
No shell execution, file deletion, or excessive agency is requested.
Details
Evidence
No declared tools section.
Use output/transcribe/<job-id>/ for evaluation runs.
ForgeCat