Parakeet Stt
PassAudited by VirusTotal on May 12, 2026.
Overview
Type: OpenClaw Skill Name: parakeet-stt Version: 1.1.0 The skill bundle describes how to set up and use a local speech-to-text service. It instructs the agent to clone a GitHub repository (`https://github.com/groxaxo/parakeet-tdt-0.6b-v3-fastapi-openai.git`), install dependencies via `pip`, and run a `uvicorn` server or `docker compose`. All instructions in `SKILL.md` are directly related to installing and using this local service, primarily involving sending local audio files to a local endpoint for transcription. There is no evidence of data exfiltration, malicious execution, persistence mechanisms, or prompt injection attempts designed to subvert the agent's behavior or access unrelated sensitive data. The behavior is clearly aligned with the stated purpose and lacks meaningful high-risk activities.
Findings (0)
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
Installing the skill’s backend may run code and dependencies that were not part of this review.
The skill relies on code and dependencies from an external repository that are not included in the reviewed artifact. This is purpose-aligned for running the STT service, but users must trust that upstream project.
git clone https://github.com/groxaxo/parakeet-tdt-0.6b-v3-fastapi-openai.git ... docker compose up -d parakeet-cpu ... pip install -r requirements.txt
Review the upstream repository, Docker Compose file, and requirements before running them; pin to a trusted commit if possible.
If your firewall or network allows it, other machines may be able to reach the transcription service.
The direct Python example can expose the transcription API on all network interfaces and shows no API authentication. This is disclosed and related to serving the local API, but it is broader than binding only to localhost.
uvicorn app.main:app --host 0.0.0.0 --port 5000 ... api_key="not-needed"
Prefer binding to 127.0.0.1/localhost, keep the port firewalled, and do not expose the service publicly unless you add access controls.
The service may continue using CPU, memory, storage, and port 5000 until you stop it.
The recommended Docker mode starts a detached background service, but the documentation also gives explicit stop and management commands.
docker compose up -d parakeet-cpu ... docker compose down
Use the documented Docker management commands, and stop the container with docker compose down when you no longer need transcription.