Agent Economy ReportAgent Economy ReportCAUTION version 1.0.0 · audited 2026-09-17
This skill adds a bash script that sends a local audio file to OpenAI's Whisper transcription API using curl, with options for model, language, prompt, and text or JSON output. It requires an audio file and the OPENAI_API_KEY environment variable, and it writes the transcript to either a calculated path or the path given by --out. The code only contacts api.openai.com and does not install packages, hide files, persist services, or redirect payments. The main considerations are that the selected audio is uploaded to OpenAI and the output file can be written wherever the agent has write access.
| Declared purpose | Transcribe audio via OpenAI Audio Transcriptions API (Whisper). |
| Observed behavior | When run, scripts/transcribe.sh parses command-line options for model, output path, language, prompt, and JSON mode. It verifies the input file and OPENAI_API_KEY, makes a multipart POST to https://api.openai.com/v1/audio/transcriptions with curl, writes the response body to the selected output path, and prints that path. |
| Verdict, rules only | CAUTION · reads credential-like environment variables: OPENAI_API_KEY |
| Verdict, AI | SAFE |
| Final verdict | CAUTION (never better than either pass) |
| capability | vs purpose | detail |
|---|---|---|
| network | needed | Contacts https://api.openai.com/v1/audio/transcriptions using curl. Documentation links to platform.openai.com and clawhub.ai are not contacted by the script. |
| shell | needed | The skill is a bash script run from the command line and requires bash and curl. |
| filesystem_read | needed | Reads the local audio file supplied as the first argument and checks that it exists before uploading it. |
| filesystem_write | needed | Creates the output directory and writes the API response to a text or JSON output file. |
| credentials | needed | Reads the OPENAI_API_KEY environment variable and sends it as the Authorization bearer header for the API request. |
| severity | finding |
|---|---|
| info | Declared purpose matches implementation The package declares audio transcription via the OpenAI Audio Transcriptions API, which is what the script does. SKILL.md:3 description: Transcribe audio via OpenAI Audio Transcriptions API (Whisper). |
| info | Documented command runs the bash script The quick-start command invokes the transcription script on a local audio file. SKILL.md:15 {baseDir}/scripts/transcribe.sh /path/to/audio.m4a |
| info | Requires OPENAI_API_KEY The script refuses to run unless the OPENAI_API_KEY environment variable is set. scripts/transcribe.sh:59 if [[ "${OPENAI_API_KEY:-}" == "" ]]; then |
| info | Creates output directory The script creates parent directories for the chosen output path before writing the transcript. scripts/transcribe.sh:73 mkdir -p "$(dirname "$out")" |
| info | Contacts only the OpenAI transcription endpoint The network operation in the script goes to the declared OpenAI API endpoint. scripts/transcribe.sh:75 curl -sS https://api.openai.com/v1/audio/transcriptions |
| low | Sends API key in Authorization header The script includes the OPENAI_API_KEY as a bearer token in the request header. This is required for the API but means the credential is exposed to the request process and OpenAI. scripts/transcribe.sh:76 -H "Authorization: Bearer $OPENAI_API_KEY" |
| low | Uploads selected local audio file The chosen audio file is read and submitted to OpenAI. This is necessary for transcription but sends the audio content to a third party. scripts/transcribe.sh:78 -F "file=@${in}" |
| low | Writes transcript to selected output path The API response is written to the computed or supplied output path. The script can write to any path the invoking agent has write permission for. scripts/transcribe.sh:83 >"$out" |
| info | Known data-sharing risk is disclosed The skill card explicitly discloses that audio files and submitted fields are sent to OpenAI with the user's API key. skill-card.md:24 Risk: Selected audio files and optional prompt, language, and model fields are sent to OpenAI using the user's API key. |
0 AI finding(s) were dropped because their file, line or quote did not match the package.
| domain | service rating | where |
|---|---|---|
| api.openai.com | not in the service index | scripts/transcribe.sh:75 |
| clawhub.ai | not in the service index | skill-card.md:9 |
| platform.openai.com | not in the service index | SKILL.md:4 |
| Binaries invoked | bash, curl |
| Environment variables read | OPENAI_API_KEY |
| Hard-coded wallets | none |
| Pipes a download to a shell | 0 |
| eval / exec / subprocess | 0 |
| base64 blobs | 0 |
| File writes | 1 |
| Persistence | 0 |
| file | lines | sha256 |
|---|---|---|
SKILL.md | 43 | 4cd90ed4d059a385… |
_meta.json | 6 | 3aaf1587c4bd41e1… |
scripts/transcribe.sh | 85 | 06d255cdd1a44ea3… |
skill-card.md | 49 | c28cac3b9d6620d7… |
For agents
JSON: https://agenteconomy.report/k/openai-whisper-api.audit.json · badge: https://agenteconomy.report/k/openai-whisper-api.audited.svg ·
skill rating: /k/openai-whisper-api · commission an audit of any skill: US$ 29 per version.
The complete published package of this exact version was downloaded from the registry and read statically; nothing was executed. A deterministic pass extracts network destinations, binaries, environment variables, writes, install commands, obfuscation markers, subprocesses and wallets, each with file and line. An AI then reads the whole package with those facts and writes the summary, the capabilities and the findings under a strict schema; every finding it produces must cite a file, a line and the exact text, or it is dropped. The final verdict is the worst of the two passes. The audit does not change the skill's trust tier (policy); the author may respond through the dispute channel and the response is published here. Commissioned by: the Agent Economy Report (free program: the 150 most downloaded skills, September 2026).