Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

Alicloud Ai Audio Asr Realtime

v1.0.0

Use when low-latency realtime speech recognition is needed with Alibaba Cloud Model Studio Qwen ASR Realtime models, including streaming microphone input, li...

0· 316·0 current·0 all-time

Install

OpenClaw Prompt Flow

Install with OpenClaw

Best for remote or guided setup. Copy the exact prompt, then paste it into OpenClaw for cinience/alicloud-ai-audio-asr-realtime.

Previewing Install & Setup.
Prompt PreviewInstall & Setup
Install the skill "Alicloud Ai Audio Asr Realtime" (cinience/alicloud-ai-audio-asr-realtime) from ClawHub.
Skill page: https://clawhub.ai/cinience/alicloud-ai-audio-asr-realtime
Keep the work scoped to this skill only.
After install, inspect the skill metadata and help me finish setup.
Use only the metadata you can verify from ClawHub; do not invent missing requirements.
Ask before making any broader environment changes.

Command Line

CLI Commands

Use the direct CLI path if you want to install manually and keep every step visible.

OpenClaw CLI

Bare skill slug

openclaw skills install alicloud-ai-audio-asr-realtime

ClawHub CLI

Package manager switcher

npx clawhub@latest install alicloud-ai-audio-asr-realtime
Security Scan
VirusTotalVirusTotal
Benign
View report →
OpenClawOpenClaw
Suspicious
high confidence
Purpose & Capability
The name/description and included helper script align with realtime ASR on Alibaba Cloud Model Studio Qwen ASR. Asking for an API key or ~/.alibabacloud/credentials in the SKILL.md is appropriate for an Alibaba Cloud integration. However, the registry metadata claims no required environment variables or primary credential, which contradicts the SKILL.md.
!
Instruction Scope
SKILL.md is otherwise narrowly scoped (prepare a request JSON, guidance for streaming use). But two concerns: (1) the validation command references a path 'skills/ai/audio/alicloud-ai-audio-asr-realtime/scripts/prepare_realtime_asr_request.py' that does not match the bundled file location ('scripts/prepare_realtime_asr_request.py'), so the provided validation step may fail or mislead. (2) SKILL.md instructs the agent to 'Save session payloads and response samples under output/...', which is reasonable for debugging but means the skill will persist transcripts and possibly audio locally — users should be aware of that storage and retention.
Install Mechanism
No install spec; the skill is instruction-only with a small helper script. This minimizes installer-related risk.
!
Credentials
The SKILL.md requires DASHSCOPE_API_KEY or ~/.alibabacloud/credentials, but the skill metadata declares no required env vars or primary credential. That mismatch is a red flag: either the metadata is incomplete (expected) or the SKILL.md is asking for credentials the registry doesn't advertise. Any API key should be scoped to the minimum required permissions and stored securely.
Persistence & Privilege
always is false and the skill does not request system-wide changes or persistent/autonomous privileges. It writes output into an output/ subdirectory (as documented), which is normal for a helper tool.
What to consider before installing
This skill appears to implement what it claims (a tiny helper for Alibaba Cloud realtime ASR), but there are two practical issues to check before installing: (1) SKILL.md requires a DASHSCOPE_API_KEY or credentials file, yet the package metadata doesn't list any required env vars—confirm which credential(s) the skill actually needs and scope them minimally. (2) The validation command references a file path that doesn't match the included file layout, so the provided validation step may fail; verify the correct paths. Also be aware the skill instructs saving session payloads to output/, so decide whether storing transcripts/audio locally is acceptable and where those files will reside. If you need more assurance, ask the publisher to fix the metadata (declare DASHSCOPE_API_KEY) and correct the validation path.

Like a lobster shell, security has layers — review code before you run it.

latestvk97ccwg0jzrz3q670vvnwcaz4182qgnt
316downloads
0stars
1versions
Updated 10h ago
v1.0.0
MIT-0

Category: provider

Model Studio Qwen ASR Realtime

Validation

mkdir -p output/alicloud-ai-audio-asr-realtime
python -m py_compile skills/ai/audio/alicloud-ai-audio-asr-realtime/scripts/prepare_realtime_asr_request.py && echo "py_compile_ok" > output/alicloud-ai-audio-asr-realtime/validate.txt

Pass criteria: command exits 0 and output/alicloud-ai-audio-asr-realtime/validate.txt is generated.

Output And Evidence

  • Save session payloads and response samples under output/alicloud-ai-audio-asr-realtime/.

Critical model names

Use one of these exact model strings:

  • qwen3-asr-flash-realtime
  • qwen3-asr-flash-realtime-2026-02-10

Use cases

  • Realtime subtitles and captions
  • Voice-agent duplex input
  • Streaming speech-to-text in browser or terminal clients

Prerequisites

  • Set DASHSCOPE_API_KEY in your environment, or add dashscope_api_key to ~/.alibabacloud/credentials.
  • Realtime sessions generally require WebSocket or streaming session handling in the client.

Normalized interface (asr.realtime)

Request

  • model (string, optional): default qwen3-asr-flash-realtime
  • language_hints (array<string>, optional)
  • format (string, optional): e.g. pcm, wav
  • sample_rate (int, optional): e.g. 16000
  • chunk_ms (int, optional): frame size in milliseconds

Response

  • text (string): recognized transcript fragment
  • is_final (bool): finalization marker
  • usage (object, optional)

Quick start

Generate a request template:

python skills/ai/audio/alicloud-ai-audio-asr-realtime/scripts/prepare_realtime_asr_request.py \
  --output output/alicloud-ai-audio-asr-realtime/request.json

Operational guidance

  • Prefer 16kHz mono PCM unless your client stack requires another format.
  • Keep chunks small enough for responsive partial results.
  • If you only have recorded files, use skills/ai/audio/alicloud-ai-audio-asr/ instead.

References

  • references/sources.md

Comments

Loading comments...