Speechall command-line tool for fast speech-to-text transcription using multiple providers

PassAudited by ClawScan on May 1, 2026.

Overview

This is a coherent transcription CLI guide, with expected cautions around installing an external binary, using an API key, and uploading selected media for transcription.

This skill appears safe for its stated purpose. Before installing, verify the Speechall tap or GitHub release is official, keep your API key private, and only upload recordings whose contents you are comfortable sending to an external transcription service.

Findings (3)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

What this means

Installing the CLI gives locally executed software access to files the user passes to it and whatever the binary itself is capable of doing.

Why it was flagged

The skill instructs users to install an external CLI binary/tap that is not included in the artifact set or pinned to a specific version. This is expected for the stated CLI-install purpose, but provenance should be checked.

Skill content
brew install Speechall/tap/speechall ... Download the binary for your platform from https://github.com/Speechall/speechall-cli/releases
Recommendation

Install only from the official Speechall source, review the release/tap URL, and prefer a known version if reproducibility matters.

What this means

Anyone who obtains the API key may be able to use the user's Speechall account or incur usage under it.

Why it was flagged

The skill requires an account API key for the transcription service. This is expected for the integration, but the key is a credential that should be protected.

Skill content
An API key is required. Provide it via environment variable (preferred) or flag: export SPEECHALL_API_KEY="your-key-here"
Recommendation

Use the environment variable method or a secret manager, avoid pasting keys into shared logs or command history, and rotate the key if exposed.

What this means

Audio or video files may contain private conversations or business information that will be sent outside the local machine for transcription.

Why it was flagged

The skill discloses that selected audio/video content is uploaded to Speechall and may be processed through provider integrations. This is central to transcription, but it crosses an external service boundary.

Skill content
CLI for speech-to-text transcription via the Speechall API. Supports multiple providers ... On macOS, video files (`.mp4`, `.mov`, etc.) are automatically converted to audio before upload.
Recommendation

Only transcribe files you are comfortable uploading to the service, and review Speechall/provider privacy and retention settings for sensitive recordings.