Chen Openai Whisper

PassAudited by ClawScan on May 1, 2026.

Overview

This instruction-only skill coherently installs and runs the local Whisper transcription CLI, with only expected notes about external installation/model downloads and minor provenance ambiguity.

This appears safe for its purpose if you are comfortable installing the Whisper CLI and downloading models locally. Before installing, confirm the package/source is the one you expect, and only transcribe audio files you are comfortable processing on this machine.

Findings (3)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

What this means

Installing or first using the skill may download software and model files onto the local machine.

Why it was flagged

The skill depends on an external Homebrew package and first-run model downloads. This is disclosed and necessary for local Whisper transcription, but it is still a supply-chain dependency users should trust before installing.

Skill content
"install":[{"id":"brew","kind":"brew","formula":"openai-whisper","bins":["whisper"]}] ... Models download to `~/.cache/whisper` on first run.
Recommendation

Install only from a trusted Homebrew setup, expect the model cache download, and verify the package source if supply-chain integrity is important.

What this means

The skill's package identity is not perfectly consistent across the provided metadata.

Why it was flagged

The embedded metadata identity differs from the registry metadata shown for this evaluation, which lists a different owner and slug. This creates minor provenance ambiguity, though no unsafe behavior is shown.

Skill content
"ownerId": "kn70pywhg0fyz996kpa8xj89s57yhv26", "slug": "openai-whisper"
Recommendation

Confirm that the listed publisher and package are the ones you intend to install.

What this means

The agent may run Whisper locally and create transcript files in the chosen output directory.

Why it was flagged

The skill instructs the agent to run a local CLI command on user-provided audio and write output files. This command execution is central to the stated transcription purpose and is not hidden or automatic.

Skill content
`whisper /path/audio.mp3 --model medium --output_format txt --output_dir .`
Recommendation

Use the skill only on audio files you intend to transcribe, and specify an output directory where transcript files are expected.