Security audit
Security checks for vulnerabilities and agentic risk
This skill is a coherent speech-to-text tool, but users should be aware that cloud engines can send audio to third-party services and the install downloads an external executable.
Before installing, confirm you trust the GitHub release source for the downloaded executable. Use local engines for private or regulated recordings, and choose cloud engines only when you are comfortable sending the audio to that provider under its policies. Review the default language setting if Chinese is not your expected default.
The trigger list includes generic conditions such as 'User wants to transcribe audio, speech, or voice to text' and 'User needs speech recognition or ASR' without narrowing context or exclusion conditions. In a markdown skill description, this can cause the skill to match many ordinary requests too broadly and makes it unclear when the skill should not activate.
The cloud-engine examples instruct users to send audio to OpenAI, Doubao, and Deepgram without an explicit warning that the audio leaves the local machine and is transmitted to third-party services. In a speech-transcription skill, audio may contain sensitive personal, corporate, or regulated data, so omission of this disclosure increases the risk of unintended privacy and compliance violations.
The configuration declares default_lang with a default of zh, and the examples and flag table also reinforce Chinese as the default. This is a locale preference imposed by default rather than chosen by the user, which can conflict with language/locale policy expectations unless explicitly justified or opt-in.
No suspicious patterns detected.
