Qwen ASR

• Analyzed: May 11, 2026, 7:41 AM
• Findings: 1
• Version: 0.1.2
• Hash: 5a06044fd310ee2da39874e50545ffa353c1c27fa8fa0a11af0aa4cd1aa01614
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill provides local speech-to-text by downloading a pre-compiled binary from a third-party GitHub repository (huanglizhuo/QwenASR) and a 1.5GB model from HuggingFace. While these actions are aligned with the stated purpose of the tool, downloading and executing unverified binaries from external sources is a high-risk capability. The scripts (install.sh and transcribe.sh) are functionally sound and do not show signs of intentional malice, data exfiltration, or prompt injection.