pi-media-transcribe@0.2.3
Local-first transcription to structured Markdown notes: transcribe YouTube, podcasts and meetings offline with Whisper or Qwen3-ASR, then optionally have an LLM proofread, segment, summarize and file into any notes folder or Obsidian vault.
AI Security Review
scanned 4d ago · by lpm-firewall-aiThe default polished flow can read an OpenAI or OpenRouter credential from Pi's auth file and send it to the DeepSeek endpoint without provider matching or explicit consent to share that credential. This is credential exfiltration across services, even though sending the transcript to an LLM is part of the package's intended feature.
Static reason
No blocking static signals were detected.
Trigger
Running the normal polished note command without an explicit LLM key or endpoint; raw mode bypasses the LLM.
Impact
A credential for one AI provider may be disclosed to another provider, allowing the receiving service to use that credential.
Mechanism
The helper reads ~/.pi/agent/auth.json, selects a key from DeepSeek, OpenAI, or OpenRouter, and sends it as a Bearer token to the configured endpoint, which defaults to https://api.deepseek.com. It does not match the key's provider to the endpoint.
Attack narrative
When polished transcription runs without an explicitly supplied key, the helper falls back to Pi's stored credentials. It accepts OpenAI and OpenRouter keys as well as DeepSeek keys, but the default endpoint is DeepSeek and the code sends the selected key in the Authorization header without verifying that the provider matches. A stored credential can therefore be disclosed to a different AI provider. The raw mode skips the LLM request.
AI rationale
The default polished flow can read an OpenAI or OpenRouter credential from Pi's auth file and send it to the DeepSeek endpoint without provider matching or explicit consent to share that credential. This is credential exfiltration across services, even though sending the transcript to an LLM is part of the package's intended feature.
Evidence
skills/media-transcribe/scripts/llm_to_obsidian.pyskills/media-transcribe/scripts/to-obsidian.sh~/.pi/agent/auth.json
Network endpoints2
api.deepseek.com/v1/chat/completionsConfigured LLM endpoint from LLM_BASE_URL or llm.baseUrl
Decision evidence
public snapshotAI called this Malicious at 96.0% confidence as Malware with low false-positive risk.
Evidence for block
- The polished transcription path resolves an LLM key automatically from Pi's stored auth file when environment/config keys are absent.
- The fallback reads stored keys for DeepSeek, OpenAI, and OpenRouter without checking that the key provider matches the LLM endpoint.
- The default LLM endpoint is https://api.deepseek.com, and the request sends the selected key as a Bearer token.
- The ordinary polished command invokes this flow; --raw is the explicit path that skips the LLM.
Evidence against
- The package is intended to send transcripts to an OpenAI-compatible LLM for proofreading and summarization.
- The LLM endpoint can be configured, and raw mode avoids sending a key or transcript to an LLM.
Behavioral surface
Source & flagged code
7 flaggedskills/media-transcribe/scripts/llm_to_obsidian.pyView file
242def api_key_from_pi_auth() -> str | None:
"""Fall back to a key Pi already stores, if present."""
auth = Path.home() / ".pi" / "agent" / "auth.json"
if not auth.is_file():
return None
try:
data = json.loads(auth.read_text(encoding="utf-8"))
except Exception: # noqa: BLE001
return None
for provider in ("deepseek", "openai", "openrouter"):
key = (data.get(provider) or {}).get("key")
if isinstance(key, st
High
Ai Review Evidence
The polished transcription path resolves an LLM key automatically from Pi's stored auth file when environment/config keys are absent.
skills/media-transcribe/scripts/llm_to_obsidian.pyView on unpkg · L242242def api_key_from_pi_auth() -> str | None:
"""Fall back to a key Pi already stores, if present."""
auth = Path.home() / ".pi" / "agent" / "auth.json"
if not auth.is_file():
return None
try:
data = json.loads(auth.read_text(encoding="utf-8"))
except Exception: # noqa: BLE001
return None
for provider in ("deepseek", "openai", "openrouter"):
key = (data.get(provider) or {}).get("key")
if isinstance(key, st
High
Ai Review Evidence
The fallback reads stored keys for DeepSeek, OpenAI, and OpenRouter without checking that the key provider matches the LLM endpoint.
skills/media-transcribe/scripts/llm_to_obsidian.pyFindings
6 High1 Medium
HighAi Review Evidenceskills/media-transcribe/scripts/llm_to_obsidian.py
HighAi Review Evidenceskills/media-transcribe/scripts/llm_to_obsidian.py
HighAi Review Evidenceskills/media-transcribe/scripts/llm_to_obsidian.py
HighAi Review Evidenceskills/media-transcribe/scripts/llm_to_obsidian.py
HighAi Review Evidenceskills/media-transcribe/scripts/llm_to_obsidian.py
HighAi Review Evidenceskills/media-transcribe/scripts/to-obsidian.sh
MediumShips Build Helperskills/media-transcribe/scripts/llm_to_obsidian.py
Affected versions and remediation
This report applies to pi-media-transcribe@0.2.3.
See all versions of pi-media-transcribe for other recorded verdicts.
- Avoid installing pi-media-transcribe@0.2.3. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.