asr-skill
v1.0.0This skill should be used when the user asks to "transcribe audio", "transcribe video", "convert speech to text", "generate subtitles", "create captions", "i...
⭐ 0· 81·0 current·0 all-time
by@lgwanai
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Benign
medium confidencePurpose & Capability
Name, description, SKILL.md, examples, and scripts consistently describe a local ASR transcription tool with speaker diarization and multiple output formats. The code present (transcribe.py and examples) implements task management, async/background execution, duration estimation, and calls into an asr_skill Python API for the heavy work, which fits the stated purpose.
Instruction Scope
Instructions and code operate on local files (audio/video), extract audio with ffprobe/ffmpeg, resample, load models, and write outputs. The script creates a .asr_skill directory and tasks.json in the project root to track async jobs and spawns a detached background worker (subprocess.Popen with start_new_session=True and stdout/stderr redirected to DEVNULL). There is no evidence in the provided files of external network exfiltration, but the SKILL.md notes first-run model downloads (~1GB) and those download routines are not present in the reviewed files (they likely live in the missing asr_skill package), so you should verify where models are fetched from if local-only processing and privacy are essential.
Install Mechanism
There is no install spec (instruction-only), which minimizes installer risk. However, SKILL.md claims auto-install of FunASR and FFmpeg via imageio-ffmpeg and that models are downloaded on first run; those actions are not in the shown script and would occur in imported modules (not included here). Because downloads/extracts are plausible but not visible, verify the code that performs automatic installs/downloads before running.
Credentials
The skill declares no required environment variables, credentials, or config paths and the provided code does not attempt to read secrets or unrelated system configuration. It uses local filesystem storage for tasks and relies on available binaries (ffprobe) or Python libraries (librosa), which is proportional to the stated functionality.
Persistence & Privilege
The skill does not set always:true and does not modify other skills. It does persist local state by creating a .asr_skill directory and tasks.json under the project root and spawns detached background worker processes for async jobs. These behaviors are expected for async transcription but can create persistent files and background processes that you may want to control or audit.
Assessment
This skill appears to implement what it claims (local transcription with diarization) and doesn't request secrets. Before installing or running it: 1) Inspect the asr_skill package (not included in the reviewed files) to see where and from which hosts models are downloaded and whether any network calls are made; 2) Be aware the script will create a hidden .asr_skill/tasks.json in the project root and will spawn detached background worker processes (their stdout/stderr are suppressed), so run in an isolated environment if you need to restrict resource or process creation; 3) Ensure dependencies (FunASR, imageio-ffmpeg/FFmpeg, librosa, etc.) are installed from trusted sources or pinned to known versions; 4) If privacy is critical, confirm model downloads occur from trusted hosts and consider auditing network activity on first run. If you want higher assurance, ask the publisher for the full asr_skill package source or run the skill in a sandboxed environment first.Like a lobster shell, security has layers — review code before you run it.
latestvk977xjeywpf3n3zm6525ad60zh8392xc
License
MIT-0
Free to use, modify, and redistribute. No attribution required.