Speech To Text

PassAudited by ClawScan on May 1, 2026.

Overview

This skill is a coherent speech-to-text wrapper for the inference.sh CLI, with expected but important notes around installing a third-party CLI, logging in, and sending audio to an external service.

This skill appears safe for its stated purpose. Before installing, manually verify the inference.sh CLI installer, log in only with an account you intend to use for transcription, and avoid sending confidential audio unless inference.sh is approved for that data.

Findings (4)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

What this means

The agent could run other inference.sh CLI actions if prompted or if a workflow expands beyond simple transcription.

Why it was flagged

The skill grants the agent access to any `infsh` CLI command, not only the specific Whisper transcription commands shown in the description.

Skill content
allowed-tools: Bash(infsh *)
Recommendation

Use the skill for intended transcription tasks and review any `infsh` command before allowing actions that run unrelated apps or change account state.

What this means

The skill may operate under the user's inference.sh account when running transcription jobs.

Why it was flagged

The documented setup requires logging into the inference.sh CLI, which likely creates or uses a local provider session.

Skill content
curl -fsSL https://cli.inference.sh | sh && infsh login
Recommendation

Log in deliberately, use an appropriate account, and avoid granting broader provider access than needed for transcription.

What this means

Installing the CLI trusts the remote inference.sh installer and downloaded binary.

Why it was flagged

The skill documents installation of an external CLI through a remote shell script, while the registry itself has no install spec or declared required binary.

Skill content
curl -fsSL https://cli.inference.sh | sh
Recommendation

Run installation yourself, verify the checksum or use the manual install path, and do not let an agent silently install or update the CLI.

What this means

Private audio content or accessible audio links may be processed by the external provider.

Why it was flagged

The workflow sends an audio URL to an external inference.sh app for processing; the skill also lists meetings, interviews, podcasts, and voice notes as use cases.

Skill content
infsh app run infsh/fast-whisper-large-v3 --input '{"audio_url": "https://meeting.mp3"}'
Recommendation

Only submit audio you are allowed to share with inference.sh, and review the provider's privacy and retention terms for sensitive recordings.