Faster Whisper Local Service

PassAudited by ClawScan on May 10, 2026.

Overview

This skill appears to do what it says—set up a local speech-to-text service—but it installs dependencies, downloads models, and creates a persistent local background service.

Before installing, be aware that this will create a local Python environment, install faster-whisper, download model files on first run, and enable a persistent user-level systemd service on localhost. This is consistent with the skill's purpose; uninstall it with the documented commands if you no longer need local transcription.

Findings (3)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Note

ASI04: Agentic Supply Chain Vulnerabilities

What this means

Installing the skill downloads and runs third-party Python code needed for speech transcription.

Why it was flagged

The deploy script installs a Python package into a local virtual environment. This is expected for a faster-whisper backend, but it relies on external package provenance and the default version can be overridden by environment variable.

Skill content

"$VENV/bin/pip" install "faster-whisper==${FW_VERSION}" >/dev/null

Recommendation

Install only from a trusted environment, keep the default pinned version unless you intentionally need another version, and review package updates before overriding `FASTER_WHISPER_VERSION`.

Note

ASI10: Rogue Agents

What this means

The transcription server will continue running in the background and restart automatically until you disable or uninstall it.

Why it was flagged

The script enables a persistent user-level systemd service for the transcription backend. This persistence is disclosed in SKILL.md and aligned with the service purpose.

Skill content

systemctl --user enable --now openclaw-transcribe.service

Recommendation

Use the documented uninstall commands if you no longer want the background service, and verify its status with `bash scripts/status.sh` or `systemctl --user status openclaw-transcribe.service`.

Note

ASI02: Tool Misuse and Exploitation

What this means

If run, the cleanup command removes the skill's virtual environment and generated server file, requiring redeployment to use the service again.

Why it was flagged

The documentation includes a destructive delete command, but it is presented as optional cleanup and is scoped to the skill's own generated files.

Skill content

Optional full cleanup:

```bash
rm -rf ~/.openclaw/workspace/.venv-faster-whisper
rm -f ~/.openclaw/workspace/voice-input/transcribe-server.py
```

Recommendation

Run the cleanup commands only when uninstalling and confirm the paths match the intended OpenClaw workspace before executing them.