Local Whisper

AdvisoryAudited by Static analysis on Apr 30, 2026.

Overview

No suspicious patterns detected.

Findings (0)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

NoteHigh Confidence

ASI04: Agentic Supply Chain Vulnerabilities

What this means

Installing the skill may pull Python packages from external repositories before the tool can run locally.

Why it was flagged

The setup instructions ask the user to install unpinned external Python dependencies. This is purpose-aligned for local Whisper, but it creates a normal supply-chain review point.

Skill content

uv pip install --python .venv/bin/python click openai-whisper torch --index-url https://download.pytorch.org/whl/cpu

Recommendation

Install only if you trust the package source; preferably use pinned versions or a lockfile, and verify the intended command wrapper is present before use.