ClawHub

asr

v1.0.2

Fast, accurate automatic speech-to-text transcription supporting 100 languages from URLs or local files via SkillBoss API Hub.

⭐ 0· 71·0 current·0 all-time
by@modestyrichards
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
Capability signals
Requires sensitive credentials
These labels describe what authority the skill may exercise. They are separate from suspicious or malicious moderation verdicts.
VirusTotalVirusTotal
Pending
View report →
OpenClawOpenClaw
Benign
high confidence
✓
Purpose & Capability
Name/description, SKILL.md, manifest.json, and scripts/asr.sh all consistently implement an ASR client that sends base64-encoded audio to SkillBoss API (https://api.skillboss.co/v1/pilot). The required capability (an API key) is what you'd expect for this purpose.
ℹ
Instruction Scope
Runtime instructions and the script only perform: download a URL or read a user-supplied local file, base64-encode it, and POST JSON to the SkillBoss endpoint. This is coherent for transcription, but it does transmit user audio (which may be sensitive) to an external service—users should be aware and consent to that.
✓
Install Mechanism
No install spec or remote downloads; this is instruction-only with a bundled shell script. Nothing is fetched from arbitrary URLs or written beyond temporary files in /tmp. Risk from install mechanism is low.
ℹ
Credentials
The skill uses a single API credential (SKILLBOSS_API_KEY) which is proportionate to the stated purpose. However, the registry metadata at the top of the report said "Required env vars: none" while manifest.json and SKILL.md both declare SKILLBOSS_API_KEY—this mismatch is likely a packaging/manifest oversight and should be corrected.
✓
Persistence & Privilege
The skill is not always-enabled, does not modify other skills or system-wide config, and does not request elevated or persistent system privileges. It writes transient temp files and removes them; it does not store credentials on disk.
Assessment
This skill implements a straightforward ASR client that uploads audio to SkillBoss and needs a SKILLBOSS_API_KEY. Before installing: (1) Confirm you trust https://skillboss.co and review its privacy policy because your audio will be sent there; (2) set the SKILLBOSS_API_KEY only if you intend to allow audio uploads; (3) be cautious when transcribing local files that may contain sensitive information; (4) note the minor packaging mismatch (registry metadata vs. manifest) — expect to provide the SKILLBOSS_API_KEY despite the top-level summary saying "none"; and (5) if you need offline/local-only transcription, this skill is not suitable because it depends on an external API.

Like a lobster shell, security has layers — review code before you run it.

aivk97308y0vqsz9jfx0kge4gv10584x3nqlatestvk97308y0vqsz9jfx0kge4gv10584x3nq

License

MIT-0
Free to use, modify, and redistribute. No attribution required.
Termshttps://spdx.org/licenses/MIT-0.html

Comments