Parakeet Local Asr

Install and operate local NVIDIA Parakeet ASR for OpenClaw with an OpenAI-compatible transcription API on Ubuntu/Linux and macOS (Intel/Apple Silicon). Use w...

Security Scan

The skill's purpose (install/run local Parakeet ASR) matches its scripts, but it clones and executes code from an external GitHub repo without integrity checks and can pull updated/remote scripts — this is coherent but poses a clear supply-chain risk that you should review before running.

Purpose & Capability

Name/description match the behavior: scripts bootstrap, start, healthcheck, and smoke-test a local ASR service. However the bootstrap step clones and runs setup/start scripts from a remote repo (https://github.com/rundax/parakeet-asr.git by default), which is necessary for installing the ASR but introduces supply-chain trust requirements (no pinned commit or checksum).

Instruction Scope

SKILL.md tells the agent to run the provided scripts which in turn run ./setup.sh and ./start-parakeet.sh from the cloned repo. Those downstream scripts (not included here) may perform package-manager actions, install services, or contact external endpoints. The skill's own safety note says to ask before elevated/package-manager ops, but the bootstrap script directly executes the remote setup script with no verification or explicit interactive confirmation.

Install Mechanism

There is no install spec in the registry, but bootstrap.sh performs a git clone/pull from a third-party GitHub repository and runs its setup script: a high-risk download-and-execute pattern. There is no pinned commit, no signature/checksum, and subsequent pulls can change behavior after install.

Credentials

The skill declares no required credentials or config paths (reasonable for a local ASR). The scripts honor PARAKEET_DIR and PARAKEET_URL and also support overriding the repo via PARAKEET_REPO_URL (not documented in SKILL.md). That override lets callers point the installer at an arbitrary repo, which increases risk if misused.

Persistence & Privilege

The skill is user-invocable and not always-enabled. It does not itself request persistent platform privileges, but the repo's setup/start scripts (fetched at runtime) could install services or modify system configuration — this is possible but not evident from the included files.

What to consider before installing

This skill does what it claims (sets up a local Parakeet ASR) but its installer clones and executes third-party code from GitHub with no verification. Before running: 1) Review the remote repository (setup.sh and start-parakeet.sh) yourself or run the bootstrap in an isolated VM/container. 2) Avoid setting PARAKEET_REPO_URL to untrusted repos. 3) Prefer a pinned commit or checksum; if you must use the default repo, inspect its setup script after cloning and before executing. 4) Run as a non-root user, and consider blocking outbound network access until you confirm expected behavior. If you are not comfortable auditing the remote repo, do not run these scripts on production or sensitive machines.

Run local Parakeet ASR in a deterministic way.

Standard workflow

1. Install/update runtime:

   bash scripts/bootstrap.sh
   

2. Start service:

   bash scripts/start.sh
   

3. Validate service health:

   bash scripts/healthcheck.sh
   

4. (Optional) Run a smoke transcription test with a local audio file:

   bash scripts/smoke-test.sh /path/to/audio.mp3
   

Repo location

Default install/update path used by scripts:

• ~/parakeet-asr

Override with env var before running scripts:

PARAKEET_DIR=/custom/path bash scripts/bootstrap.sh

OpenClaw integration notes

After healthcheck passes, use:

• URL: http://localhost:9001
• Endpoint: /v1/audio/transcriptions

If a user requests reliability over purity, keep Whisper as fallback provider.

Safety rules

• Ask before elevated/package-manager operations.
• Do not kill unrelated processes.
• Keep changes scoped to ASR setup unless explicitly asked.