Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

Local Vosk STT

v1.0.1

Local speech-to-text using Vosk. Lightweight, fast, fully offline. Perfect for transcribing Telegram voice messages, audio files, or any speech-to-text task without cloud APIs.

0· 1k·2 current·2 all-time
byMike Sutherland@sfkiwi

Install

OpenClaw Prompt Flow

Install with OpenClaw

Best for remote or guided setup. Copy the exact prompt, then paste it into OpenClaw for sfkiwi/local-vosk.

Previewing Install & Setup.
Prompt PreviewInstall & Setup
Install the skill "Local Vosk STT" (sfkiwi/local-vosk) from ClawHub.
Skill page: https://clawhub.ai/sfkiwi/local-vosk
Keep the work scoped to this skill only.
After install, inspect the skill metadata and help me finish setup.
Use only the metadata you can verify from ClawHub; do not invent missing requirements.
Ask before making any broader environment changes.

Command Line

CLI Commands

Use the direct CLI path if you want to install manually and keep every step visible.

OpenClaw CLI

Canonical install target

openclaw skills install sfkiwi/local-vosk

ClawHub CLI

Package manager switcher

npx clawhub@latest install local-vosk
Security Scan
VirusTotalVirusTotal
Suspicious
View report →
OpenClawOpenClaw
Suspicious
high confidence
!
Purpose & Capability
The description (local offline STT) matches the instructions (use vosk, download models). However SKILL.md instructs running ./skills/local-vosk/scripts/transcribe which implies bundled scripts/code that are not present in the package. Also the doc expects ffmpeg for decoding audio but the skill declares no required binaries. These gaps are disproportionate to the stated purpose.
!
Instruction Scope
Instructions tell the agent/user to run a local script path and to pip-install vosk and download models. Because there are no code files, an agent following these instructions would fail or attempt to run non-existent scripts. The instructions reference system actions (pip install, wget, unzip, writing to ~/vosk-models) that are reasonable for setup but include the unusual pip flag --break-system-packages without explanation.
Install Mechanism
There is no formal install spec (instruction-only), which is lower risk. The manual install commands point to a legitimate upstream site (alphacephei.com) for models and use pip/wget/unzip. Those sources are expected for Vosk models; no high-risk download URLs or shorteners are used. Still, because the skill lacks bundled code, it's unclear what the referenced scripts would do when present.
Credentials
The skill requests no environment variables or credentials, which is appropriate for an offline STT tool. No unrelated secrets are requested.
Persistence & Privilege
The skill does not request always:true and does not claim to modify other skills or system settings. It appears to be an on-demand instruction-only skill.
What to consider before installing
Don't install or run this skill as-is. SKILL.md expects a local script at ./skills/local-vosk/scripts/transcribe, but the package contains no code files — ask the publisher for the missing scripts or a corrected package. If you plan to run the provided setup commands yourself: ensure ffmpeg is installed (the README mentions it but the skill doesn't declare it), verify the model download source and checksums, and avoid running pip with unexplained flags like --break-system-packages unless you know what they do. Prefer a packaged release (includes the transcribe script) or run Vosk in an isolated environment/container until the skill's files and provenance are confirmed.

Like a lobster shell, security has layers — review code before you run it.

latestvk970x5032syarzbdrn75keqfjd80xez6
1kdownloads
0stars
2versions
Updated 22h ago
v1.0.1
MIT-0

Local Vosk STT

Lightweight local speech-to-text using Vosk. Fully offline after model download.

Use Cases

  • Telegram voice messages — transcribe .ogg voice notes automatically
  • Audio files — any format ffmpeg supports
  • Offline transcription — no API keys, no cloud, no costs

Quick Start

# Transcribe Telegram voice message
./skills/local-vosk/scripts/transcribe voice_message.ogg

# Transcribe any audio
./skills/local-vosk/scripts/transcribe audio.mp3

# With language (default: en-us)
./skills/local-vosk/scripts/transcribe audio.wav --lang en-us

Supported Formats

Any format ffmpeg can decode: ogg (Telegram), mp3, wav, m4a, webm, flac, etc.

Models

Default model: vosk-model-small-en-us-0.15 (~40MB)

Other models available at https://alphacephei.com/vosk/models

Setup (if not installed)

pip3 install vosk --user --break-system-packages

# Download model
mkdir -p ~/vosk-models && cd ~/vosk-models
wget https://alphacephei.com/vosk/models/vosk-model-small-en-us-0.15.zip
unzip vosk-model-small-en-us-0.15.zip

Notes

  • Quality is good for conversational speech
  • For higher accuracy, use larger models or faster-whisper
  • Processes audio at ~10x realtime on typical hardware
  • Telegram voice messages are .ogg format — works out of the box

Comments

Loading comments...