Transcribe

PassAudited by ClawScan on May 1, 2026.

Overview

This appears to be a local audio transcription helper, but its manual Docker installer is incomplete and uses unpinned external dependencies, so review the installer before use.

This skill is reasonable for local transcription, but before installing, verify that you have the complete scripts/transcribe wrapper, review the sudo install step, and consider pinning or otherwise trusting the Docker/Python/model dependencies. Only transcribe audio files you are comfortable processing locally.

Findings (3)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Note

ASI04: Agentic Supply Chain Vulnerabilities

What this means

The Docker image built during installation can vary over time depending on upstream package and model changes.

Why it was flagged

The manual installer pulls an unpinned Docker base image, installs an unpinned Python package, and pre-downloads a model during build. This is expected for a local Whisper setup, but the install-time inputs are not pinned.

Skill content

FROM python:3.11-slim
RUN pip install --no-cache-dir faster-whisper
RUN python3 -c "from faster_whisper import WhisperModel; WhisperModel('small', device='cpu', compute_type='int8')"

Recommendation

Build only in a trusted environment and consider pinning the Docker image, Python package version, and model source before installation.

Note

ASI04: Agentic Supply Chain Vulnerabilities

What this means

The advertised transcribe command may not install successfully, and the intended wrapper behavior is not available for review in the provided artifacts.

Why it was flagged

The installer copies a scripts/transcribe wrapper, but the provided file manifest includes only SKILL.md and scripts/install.sh. SKILL.md also references scripts/transcribe, so the package appears incomplete.

Skill content

sudo cp "$SCRIPT_DIR/transcribe" /usr/local/bin/transcribe

Recommendation

Obtain and review a complete package including scripts/transcribe before running the installer.

Note

ASI03: Identity and Privilege Abuse

What this means

Running the installer can add or replace a system-wide command named transcribe.

Why it was flagged

The install step requests elevated privileges to write an executable into a system command directory. This is a common CLI install pattern and is purpose-aligned, but it affects a privileged path.

Skill content

sudo cp "$SCRIPT_DIR/transcribe" /usr/local/bin/transcribe
sudo chmod +x /usr/local/bin/transcribe

Recommendation

Review the installed wrapper first, or install to a user-local bin directory if you do not want system-wide changes.