qqbot-stt

Before installing or running this skill: - Treat it as suspicious until you verify sources: the SKILL.md and files refer to 'local-stt' while registry metadata says 'qqbot-stt' — verify you obtained the intended package. - Do not run the server or scripts as root. Run them in an isolated environment (dedicated user account or container/VM). - Inspect and confirm the file referenced by main.py (QWEN_ASR_SCRIPT = /Users/reks/.openclaw/skills/qwen-asr/scripts/main.py). Hard-coded absolute paths are unexpected and could point to mispackaging; ensure that path is what you expect or change it to the correct local script. - The requirements.txt is incomplete. Expect to manually install heavy ML packages (torch/transformers or an 'mlx_qwen3_asr' package) and ffmpeg; these will pull code from PyPI/HuggingFace (including 'trust_remote_code=True' in suggested code), which increases supply-chain risk — review those packages' sources first. - The code runs subprocesses (ffmpeg, model CLI) and spawns other Python modules. Review any third-party module (especially 'mlx_qwen3_asr' or 'qwen-asr') for network behavior before allowing model downloads. - If you proceed, run first in an isolated VM or container, confirm it only binds to localhost and does not exfiltrate data, and verify logs and network connections during the initial model download and runtime. If you want, provide the upstream repository URL or the contents of the referenced qwen-asr scripts; that additional context would raise or lower confidence in this assessment.