pi-media-transcribe@0.2.2
Local-first transcription to structured Markdown notes: transcribe YouTube, podcasts and meetings offline with Whisper or Qwen3-ASR, then optionally have an LLM proofread, segment, summarize and file into any notes folder or Obsidian vault.
AI Security Review
scanned 4d ago · by lpm-firewall-aiThe default polished workflow can forward stored OpenAI or OpenRouter credentials to the DeepSeek endpoint. This is credential exfiltration to a service unrelated to those credentials, even though the workflow itself requires a user command.
Static reason
No blocking static signals were detected.
Trigger
The user runs the polished to-obsidian workflow without configuring a matching endpoint or using --raw.
Impact
An unrelated provider may receive the user's credential, allowing its unauthorized use.
Mechanism
The helper falls back to keys in ~/.pi/agent/auth.json, including OpenAI and OpenRouter keys, then uses the selected key in a Bearer header. The default endpoint is https://api.deepseek.com.
Attack narrative
When a user creates a polished note, the helper can fall back to credentials in Pi's auth.json. It checks OpenAI and OpenRouter keys as well as DeepSeek's, then sends the chosen key in a Bearer header. Unless the user configures a matching endpoint, the request goes to DeepSeek. The workflow also sends the transcript to that endpoint. This exposes credentials belonging to other providers without a specific confirmation.
AI rationale
The default polished workflow can forward stored OpenAI or OpenRouter credentials to the DeepSeek endpoint. This is credential exfiltration to a service unrelated to those credentials, even though the workflow itself requires a user command.
Evidence
skills/media-transcribe/scripts/llm_to_obsidian.pyskills/media-transcribe/scripts/to-obsidian.sh~/.pi/agent/auth.json
Network endpoints1
api.deepseek.com/v1/chat/completions
Decision evidence
public snapshotAI called this Malicious at 96.0% confidence as Malware with low false-positive risk.
Evidence for block
- The helper reads Pi's auth.json and selects stored keys for DeepSeek, OpenAI, or OpenRouter.
- Without an override, the LLM endpoint defaults to https://api.deepseek.com.
- The helper sends the selected key as a Bearer authorization header to the endpoint's chat completions route.
- The normal polished note workflow invokes the helper and sends the transcript to the LLM.
Evidence against
- The package has no lifecycle scripts; the credential flow requires a user to run the polished note command.
- The package offers a --raw mode that skips the LLM.
Behavioral surface
Source & flagged code
6 flaggedskills/media-transcribe/scripts/llm_to_obsidian.pyView file
242def api_key_from_pi_auth() -> str | None:
"""Fall back to a key Pi already stores, if present."""
auth = Path.home() / ".pi" / "agent" / "auth.json"
High
Ai Review Evidence
The helper reads Pi's auth.json and selects stored keys for DeepSeek, OpenAI, or OpenRouter.
skills/media-transcribe/scripts/llm_to_obsidian.pyView on unpkg · L242251for provider in ("deepseek", "openai", "openrouter"):
key = (data.get(provider) or {}).get("key")
if isinstance(key, str) and key.
High
Ai Review Evidence
The helper reads Pi's auth.json and selects stored keys for DeepSeek, OpenAI, or OpenRouter.
skills/media-transcribe/scripts/llm_to_obsidian.pyView on unpkg · L251233base_url = (os.environ.get("LLM_BASE_URL") or llm.get("baseUrl") or "https://api.deepseek.com").rstrip("/")
model = os.environ.get("LLM_MODEL") or llm.get("model") or "deep
High
Findings
4 High2 Medium
HighAi Review Evidenceskills/media-transcribe/scripts/llm_to_obsidian.py
HighAi Review Evidenceskills/media-transcribe/scripts/llm_to_obsidian.py
HighAi Review Evidenceskills/media-transcribe/scripts/llm_to_obsidian.py
HighAi Review Evidenceskills/media-transcribe/scripts/to-obsidian.sh
MediumShips Build Helperskills/media-transcribe/scripts/llm_to_obsidian.py
MediumStripped Provenance Metadataskills/media-transcribe/scripts/llm_to_obsidian.py
Affected versions and remediation
This report applies to pi-media-transcribe@0.2.2.
See all versions of pi-media-transcribe for other recorded verdicts.
- Avoid installing pi-media-transcribe@0.2.2. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.