Gemini STT

• Analyzed: May 13, 2026, 3:01 AM
• Findings: 1
• Version: 1.1.0
• Hash: 2970d61bc8b0dd9c336621efe3a62211813a2e0569cc470559cc3078e1553130
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill is designed to transcribe audio files using Google's Gemini API or Vertex AI. The `transcribe.py` script legitimately uses `subprocess` to interact with the `gcloud` CLI for authentication (retrieving access tokens and project IDs) and sends base64-encoded audio data to official Google API endpoints. There is no evidence of data exfiltration to unauthorized parties, malicious execution, persistence mechanisms, or prompt injection attempts against the OpenClaw agent in `SKILL.md`. All actions are aligned with the stated purpose of speech-to-text transcription.