Speech is Cheap Transcribe
v1.2.0Fast, affordable automatic speech-to-text transcription supporting 100 languages, speaker diarization, word timestamps, and customizable output formats.
⭐ 5· 2.6k·8 current·8 all-time
by@ilyakam
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Benign
high confidencePurpose & Capability
Name, SKILL.md, manifest, and the included scripts all implement an automatic speech-to-text client that calls Speech is Cheap APIs. The single required secret (SIC_API_KEY) is appropriate for an external ASR service. There are no unrelated credentials, surprising binaries, or unrelated install steps.
Instruction Scope
Runtime instructions and the script only perform expected actions: submit a URL or upload a local file to the service, poll job status, and accept a webhook URL for callbacks. Important operational notes: (1) local files are uploaded (input_file=@...), so any local audio passed to the skill will be transmitted to upload.speechischeap.com; (2) when transcribing by URL, the remote API will fetch the provided URL — supplying internal/private URLs could allow that external service to retrieve internal resources (SSRF risk). These behaviours are expected for a transcription client but are privacy/safety considerations rather than incoherence.
Install Mechanism
There is no install spec (instruction-only skill) and the script is included as a plain bash file — this is low risk. Minor inconsistency: the script uses curl but the skill metadata lists no required binaries; agents should ensure curl (or an equivalent HTTP client) is available.
Credentials
Only SIC_API_KEY is declared and used by the script. The environment requirement is proportional to the skill's purpose and is documented in SKILL.md and manifest.json. No other environment variables or secret-scoped config paths are accessed.
Persistence & Privilege
The skill does not request always:true, does not declare elevated persistence, and does not modify other skills or global config. It runs as a CLI wrapper and relies on the agent invoking its commands.
Assessment
This skill appears to do exactly what it claims: it uploads audio (local files or URLs) to Speech is Cheap and returns transcription job JSON. Before installing, consider: (1) Trust the vendor — your audio and potentially sensitive content will be sent to api.speechischeap.com / upload.speechischeap.com; (2) Protect the SIC_API_KEY like any API secret; (3) Be cautious when passing URLs — the remote service will fetch them (risk of exposing internal endpoints); (4) If you use webhooks, the skill will include your webhook URL in job requests (ensure the target is trusted); (5) Ensure curl is available on the agent host (script expects it). If you need stronger privacy, verify the provider's 'private' behavior and retention policy or avoid sending sensitive audio.Like a lobster shell, security has layers — review code before you run it.
latestvk976d4w4ggaazra4p9eyv5nbxd80akhq
License
MIT-0
Free to use, modify, and redistribute. No attribution required.