Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

Aliyun Qwen Asr Realtime

v1.0.0

Use when low-latency realtime speech recognition is needed with Alibaba Cloud Model Studio Qwen ASR Realtime models, including streaming microphone input, li...

0· 3·0 current·0 all-time
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
VirusTotalVirusTotal
Benign
View report →
OpenClawOpenClaw
Suspicious
high confidence
!
Purpose & Capability
The skill's stated purpose (Qwen ASR realtime on Alibaba Cloud) aligns with the included script and docs. However, the SKILL.md requires an Alibaba credential (DASHSCOPE_API_KEY or dashscope_api_key in ~/.alibabacloud/credentials) while the registry metadata lists no required environment variables or config paths — this mismatch is unexpected and unexplained.
Instruction Scope
Runtime instructions are narrowly scoped: generate a sample JSON payload, validate the Python script, and save session payloads under an output directory. They do instruct users to provide a DASHSCOPE_API_KEY or place credentials in ~/.alibabacloud/credentials — access to that home config file is implied but not declared in metadata.
Install Mechanism
No install spec is present and included code is a small local Python helper; nothing is downloaded or installed. This is low-risk from an install perspective.
!
Credentials
The SKILL.md requires DASHSCOPE_API_KEY (or adding dashscope_api_key to ~/.alibabacloud/credentials), which is appropriate for an Alibaba Cloud integration. But the skill metadata does not declare that environment variable or the config path; required credentials should be declared explicitly (primaryEnv missing). The credential naming (DASHSCOPE_*) is unusual compared with standard Alibaba keys — verify it is legitimate.
Persistence & Privilege
The skill does not request permanent or elevated platform privileges (always:false). It does not attempt to modify other skills or system-wide settings.
What to consider before installing
This skill appears to implement what it claims (a small helper and documentation for Alibaba Qwen ASR realtime), but the package metadata omits the credential and config-path requirements declared in SKILL.md. Before installing or providing credentials: 1) Verify the upstream source and trustworthiness (homepage/source unknown). 2) Confirm that DASHSCOPE_API_KEY is the correct and expected credential for your Alibaba account and not a misnamed secret; prefer using a dedicated API key with limited scope. 3) Prefer setting the API key in a process environment variable rather than adding secrets to ~/.alibabacloud/credentials unless you trust the code and know what will read that file. 4) Ask the publisher to update the skill metadata to explicitly declare required env vars (primaryEnv) and config paths so you can make an informed decision. 5) Monitor outputs written to output/aliyun-qwen-asr-realtime and avoid placing sensitive audio or transcripts there until you confirm behavior.

Like a lobster shell, security has layers — review code before you run it.

latestvk97bsgyzpf5np6e60xhbtns889840x92

License

MIT-0
Free to use, modify, and redistribute. No attribution required.

SKILL.md

Category: provider

Model Studio Qwen ASR Realtime

Validation

mkdir -p output/aliyun-qwen-asr-realtime
python -m py_compile skills/ai/audio/aliyun-qwen-asr-realtime/scripts/prepare_realtime_asr_request.py && echo "py_compile_ok" > output/aliyun-qwen-asr-realtime/validate.txt

Pass criteria: command exits 0 and output/aliyun-qwen-asr-realtime/validate.txt is generated.

Output And Evidence

  • Save session payloads and response samples under output/aliyun-qwen-asr-realtime/.

Critical model names

Use one of these exact model strings:

  • qwen3-asr-flash-realtime
  • qwen3-asr-flash-realtime-2026-02-10

Use cases

  • Realtime subtitles and captions
  • Voice-agent duplex input
  • Streaming speech-to-text in browser or terminal clients

Prerequisites

  • Set DASHSCOPE_API_KEY in your environment, or add dashscope_api_key to ~/.alibabacloud/credentials.
  • Realtime sessions generally require WebSocket or streaming session handling in the client.

Normalized interface (asr.realtime)

Request

  • model (string, optional): default qwen3-asr-flash-realtime
  • language_hints (array<string>, optional)
  • format (string, optional): e.g. pcm, wav
  • sample_rate (int, optional): e.g. 16000
  • chunk_ms (int, optional): frame size in milliseconds

Response

  • text (string): recognized transcript fragment
  • is_final (bool): finalization marker
  • usage (object, optional)

Quick start

Generate a request template:

python skills/ai/audio/aliyun-qwen-asr-realtime/scripts/prepare_realtime_asr_request.py \
  --output output/aliyun-qwen-asr-realtime/request.json

Operational guidance

  • Prefer 16kHz mono PCM unless your client stack requires another format.
  • Keep chunks small enough for responsive partial results.
  • If you only have recorded files, use skills/ai/audio/aliyun-qwen-asr/ instead.

References

  • references/sources.md

Files

4 total
Select a file
Select a file to preview.

Comments

Loading comments…