Security checks across malware telemetry and agentic risk
This skill mostly does what it advertises, but its CPU transcription path can launch an unsafe background shell command from user-controlled paths.
Install only if you trust TikHub and are comfortable using an API key for scraping and paid downloads. Use an isolated environment, limit API-key exposure, avoid command-line key history where possible, get authorization before collecting profile/follower/comment data, and avoid the CPU/background Whisper path until the shell command is fixed or run with tightly controlled file paths.
log_file = f"/tmp/whisper_{os.path.basename(audio_path)}.log"
nohup_cmd = f"nohup {' '.join(cmd)} > {log_file} 2>&1 &"
print(f"🚀 Whisper 后台转写启动，日志: {log_file}")
subprocess.run(nohup_cmd, shell=True)
print(f"📝 文字稿将保存到: {output_path}")
print(f"⏱️ medium 模型 CPU 转写 1 分钟音频约需 1-2 分钟，请耐心等待")
return output_pathrequests openai-whisper mlx-whisper ffmpeg
requests openai-whisper mlx-whisper ffmpeg
requests openai-whisper mlx-whisper ffmpeg
requests openai-whisper mlx-whisper ffmpeg
64/64 vendors flagged this skill as clean.