Faster Whisper Local

PassAudited by ClawScan on May 1, 2026.

Overview

This skill coherently implements local audio transcription; the main thing to notice is that its setup runs a local shell script and installs external Python/model dependencies.

Before installing, be comfortable running a local setup script that downloads Python packages and model assets. Use trusted sources, consider pinning dependencies in sensitive environments, and remember that transcripts may contain private information even though the provided artifacts keep transcription local.

Findings (2)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

What this means

Installing the skill runs local setup commands and changes the skill directory by creating an environment and installing dependencies.

Why it was flagged

The skill asks the user to run a local shell setup script, which is expected for this Python-based transcription tool but still executes commands on the user's machine.

Skill content
Execute the setup script to create a virtual environment and install dependencies... `./setup.sh`
Recommendation

Review setup.sh before running it, run it from the intended skill directory, and avoid using elevated privileges unless absolutely necessary.

What this means

The installed dependency code comes from external package repositories, so future package changes or package-source compromise could affect the local environment.

Why it was flagged

The setup process installs external Python packages from package indexes. This is purpose-aligned, but it means the installed code depends on external package provenance and versions.

Skill content
"$VENV_DIR/bin/pip" install -r "$SCRIPT_DIR/requirements.txt" ... "$VENV_DIR/bin/pip" install torch --index-url https://download.pytorch.org/whl/cu121
Recommendation

Install only from a trusted copy of the skill; for stricter environments, pin dependency versions and verify package sources or hashes.