Voice Note Transcriber Cn
v1.1.0语音笔记转文字工具 v2.1 | Voice Note Transcriber. 支持多语言识别、实时转写、说话人识别、智能摘要、音频降噪、离线识别。触发词：转写、识别、语音。
⭐ 0· 342·2 current·2 all-time
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Suspicious
medium confidencePurpose & Capability
The SKILL.md clearly describes a transcription tool (real-time, speaker diarization, denoise, offline models) — that purpose matches the content. However there is an inconsistency: the repository/registry metadata you provided lists no required binaries, while the SKILL.md metadata (YAML header) declares required binaries: [ffmpeg, whisper]. Requiring ffmpeg/whisper is reasonable for this purpose, but the mismatch between the registry-level requirements and the SKILL.md is incoherent and worth clarifying.
Instruction Scope
The instructions are high-level and stay within transcription-related activities (preprocessing audio, recognition, speaker labeling, model download). They do not instruct the agent to read unrelated system files or env vars. However the SKILL.md references downloading offline models and switching to offline mode without specifying trusted download URLs or checksums — this vagueness could permit arbitrary network downloads or use of untrusted model files if the agent follows the instructions.
Install Mechanism
There is no install spec and no code files (instruction-only), which minimizes direct installation risk. That said, the skill expects local binaries (ffmpeg, whisper) but does not provide an install mechanism or verified sources for offline models, so the agent/operator would need to fetch/install those external components manually — a place where risk can be introduced if instructions are followed from untrusted sources.
Credentials
The skill does not request any environment variables or credentials (reasonable for a local transcription tool). The only notable requirement is binaries/models. Because offline models are mentioned, the skill implicitly needs disk/network access to store model files — this is proportional to the purpose but should be explicitly declared and tied to verified sources.
Persistence & Privilege
The skill does not request always:true, does not specify modifying system-wide config, and declares no config paths or credentials. Its privilege/scope is limited to being invoked by the agent when used.
Scan Findings in Context
[no-findings] expected: The regex-based scanner found nothing to analyze because this is an instruction-only skill with no executable code. That absence of findings is expected but not proof of safety; SKILL.md still contains executable expectations (ffmpeg/whisper) and model downloads that the scanner couldn't evaluate.
What to consider before installing
This skill looks like a normal transcription helper, but there are two things to confirm before installing or using it: (1) clarify the required binaries — SKILL.md lists ffmpeg and whisper but the registry metadata does not; ensure you or the operator install ffmpeg and a trusted whisper implementation from official sources. (2) the skill refers to downloading offline models but gives no URLs or integrity checks — ask the author for exact model download URLs and checksums, or only use models from trusted vendors (official GitHub releases, vendor CDN). Avoid giving any credentials. If you must try it, run it in a sandboxed environment and verify any downloaded model binaries before use.Like a lobster shell, security has layers — review code before you run it.
latestvk979d1x6d6vfqcv2f1p0ye169h82bv6w
License
MIT-0
Free to use, modify, and redistribute. No attribution required.