Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

Deepgram Transcribe

v1.0.0

Transcribe audio via Deepgram Nova-3 API (5.26% WER, 40x faster than Whisper, built-in speaker diarization). Use when user asks to transcribe audio, podcasts...

0· 398·2 current·2 all-time
byJesse Wunderlich@jessewunderlich
Security Scan
VirusTotalVirusTotal
Suspicious
View report →
OpenClawOpenClaw
Benign
medium confidence
Purpose & Capability
Name/description match the implementation: the script posts audio to Deepgram's API and parses the response. However the registry metadata does not declare the DEEPGRAM_API_KEY environment variable nor the runtime binaries the script uses (bash, curl, python3), which is an omission/inconsistency.
Instruction Scope
SKILL.md and the script limit actions to reading an audio file, reading an API key from DEEPGRAM_API_KEY or ~/.openclaw/secrets/deepgram-api-key.txt, POSTing the audio to api.deepgram.com, and writing transcript output. There are no instructions to read unrelated files or exfiltrate other system data.
Install Mechanism
No install spec (instruction-only plus a local shell script) — nothing is downloaded or extracted. This is the lower-risk model for skills.
Credentials
The skill legitimately requires a Deepgram API key (DEEPGRAM_API_KEY or the file under ~/.openclaw/secrets). That is proportionate for its purpose, but the registry's declared requirements did not list this credential; the omission should be corrected/acknowledged.
Persistence & Privilege
The skill does not request persistent 'always' inclusion and does not modify other skills or system-wide agent settings. It reads/writes only a per-user secret file location and user-specified output files.
Assessment
This skill is coherent with its stated purpose, but check these before installing: - It will send audio files to Deepgram (api.deepgram.com). Only use it for audio you are comfortable transmitting to that provider (PII/sensitive content consideration). - Provide a Deepgram API key either as environment variable DEEPGRAM_API_KEY or by storing it at ~/.openclaw/secrets/deepgram-api-key.txt. Prefer secure file permissions (chmod 600) if you use the secrets file. - The package metadata did not list required binaries; the script requires bash (already used), curl, and python3 to run. Ensure those are available and up-to-date. - The script parses remote responses with embedded Python; while it appears to only parse JSON, avoid running it on untrusted systems or modifying it without understanding the parsing behavior. - If you need offline/local transcription only, consider alternatives; otherwise the behavior and credentials requested are proportionate for a Deepgram integration.

Like a lobster shell, security has layers — review code before you run it.

latestvk974e0vykq51j0g29x8mcrg0v9827jdv
398downloads
0stars
1versions
Updated 7h ago
v1.0.0
MIT-0

Deepgram Nova-3 Transcription

Transcribe audio files using Deepgram's Nova-3 model — more accurate and faster than OpenAI Whisper.

Why Deepgram over Whisper

  • 5.26% word error rate (vs ~8-10% for Whisper)
  • 40x faster for batch processing
  • Built-in speaker diarization (who said what)
  • Smart formatting (numbers, dates, punctuation)
  • $200 free credits on signup at deepgram.com

Setup

Store your API key:

echo "YOUR_DEEPGRAM_API_KEY" > ~/.openclaw/secrets/deepgram-api-key.txt

Or set the environment variable:

export DEEPGRAM_API_KEY="your-key-here"

Usage

bash scripts/transcribe.sh /path/to/audio.mp3
bash scripts/transcribe.sh recording.mp3 --out transcript.txt
bash scripts/transcribe.sh recording.mp3 --json --out full.json
bash scripts/transcribe.sh recording.mp3 --language es
bash scripts/transcribe.sh recording.mp3 --model nova-2

Models

ModelWERCost/minBest for
nova-3 (default)5.26%$0.0077Best accuracy
nova-2~8%$0.0043Budget-friendly
whisper-large~8-10%$0.0048Whisper parity

Supported Formats

mp3, wav, m4a, ogg, flac, webm, aiff

Fallback

If DEEPGRAM_API_KEY is not set, use the OpenAI Whisper skill instead (if installed).

Comments

Loading comments...