Trust Assessment
local-whisper received a trust score of 34/100, placing it in the Untrusted category. This skill has significant security findings that require attention before use in production.
SkillShield's automated analysis identified 5 findings: 0 critical, 4 high, 1 medium, and 0 low severity. Key findings include Sensitive path access: AI agent config, Unpinned dependencies in setup instructions.
The analysis covered 4 layers: Manifest Analysis, Static Code Analysis, Dependency Graph, LLM Behavioral Safety. The Static Code Analysis layer scored lowest at 40/100, indicating areas for improvement.
Last analyzed on February 13, 2026 (commit 13146e6a). SkillShield performs automated 4-layer security analysis on AI skills and MCP servers.
Layer Breakdown
Behavioral Risk Signals
Security Findings5
| Severity | Finding | Layer | Location | |
|---|---|---|---|---|
| HIGH | Sensitive path access: AI agent config Access to AI agent config path detected: '~/.clawdbot/'. This may indicate credential theft. Verify that access to this sensitive path is justified and declared. | Static | skills/araa47/local-whisper/SKILL.md:10 | |
| HIGH | Sensitive path access: AI agent config Access to AI agent config path detected: '~/.clawdbot/'. This may indicate credential theft. Verify that access to this sensitive path is justified and declared. | Static | skills/araa47/local-whisper/SKILL.md:13 | |
| HIGH | Sensitive path access: AI agent config Access to AI agent config path detected: '~/.clawdbot/'. This may indicate credential theft. Verify that access to this sensitive path is justified and declared. | Static | skills/araa47/local-whisper/SKILL.md:16 | |
| HIGH | Sensitive path access: AI agent config Access to AI agent config path detected: '~/.clawdbot/'. This may indicate credential theft. Verify that access to this sensitive path is justified and declared. | Static | skills/araa47/local-whisper/SKILL.md:41 | |
| MEDIUM | Unpinned dependencies in setup instructions The `SKILL.md` file provides setup instructions that install Python packages (`click`, `openai-whisper`, `torch`) without pinning them to specific versions. This can lead to supply chain vulnerabilities if a future version of any of these packages introduces malicious code, breaking changes, or is compromised. When the skill is installed or updated, it will pull the latest available versions, which might not have been reviewed for security. Pin all dependencies to specific, known-good versions (e.g., `openai-whisper==2.1.0 click==8.1.7 torch==2.2.0`). Regularly review and update pinned versions to benefit from security patches and new features. | LLM | SKILL.md:37 |
Scan History
Embed Code
[](https://skillshield.io/report/26880dafeb24574e)
Powered by SkillShield