Nex Voice

Voice note transcription and intelligent action item extraction for capture and organization of verbal communication. Record and transcribe voice notes, voic...

Security Scan

The skill mostly implements a local transcription and action-extraction tool as described, but there are implementation choices that risk leaking secrets and surprising data exfiltration when the optional LLM feature is enabled.

Purpose & Capability

Name, description, and required binaries (python3, whisper, ffmpeg) match the provided code and CLI behavior. The code implements local transcription, storage under ~/.nex-voice, search, and optional LLM-based extraction as advertised.

Instruction Scope

Runtime instructions and CLI stay within the stated domain (transcribe, extract actions, search, manage tasks). However the LLM integration sends transcripts to the configured API endpoint via a subprocess curl call (the code constructs a curl command with the API key and transcript). That transmits user data externally when enabled and also exposes the API key on the system command line (process list), which is a credential-leak risk.

Install Mechanism

There is no remote download/install spec (no arbitrary network installs). setup.sh is included and is idempotent and only creates local directories. One minor code/installation mismatch: setup.sh attempts to initialize the DB by running lib/storage.py --init, but storage.py does not expose a CLI entrypoint for --init, so the DB initialization step may not work as intended (an engineering bug, not evidence of malice).

Credentials

The skill declares no required env vars but the code optionally reads AI_API_KEY/AI_API_BASE/AI_MODEL and stores an api_key in ~/.nex-voice/config.json when you run config set-api-key. Storing API keys in plaintext config plus passing the key on the command line to curl are disproportionate risks relative to the feature: the LLM feature requires a key but the implementation leaks it to process listings and to disk.

Persistence & Privilege

The skill does not request always:true and only writes to its own data directory (~/.nex-voice) and creates a local SQLite DB. It does not modify other skills or system-wide settings. Audio and transcripts are stored locally by default; external transmission only occurs if the optional LLM feature is configured and used.

What to consider before installing

What to consider before installing: - The core functionality is coherent: the skill transcribes audio using Whisper and stores transcripts/actions under ~/.nex-voice. - If you enable the optional LLM feature (set an API key and use --use-llm), the skill will send transcripts to the configured API base. That is expected behavior but be aware it uploads your transcript data to that external service. - Implementation risk: the skill invokes curl with the API key on the command line. That can expose the API key to other users/processes on the same machine via process listings. If you plan to use LLM features, prefer to (a) not set an API key unless necessary, (b) use an ephemeral API key you can rotate, or (c) inspect and modify the code to use a secure HTTP client (requests) that sends the key in headers without exposing it on the command line. - The config file (~/.nex-voice/config.json) stores the API key in plaintext when you use config set-api-key; treat that file as sensitive and protect it with filesystem permissions or avoid storing keys there. - The setup.sh DB initialization step may be nonfunctional; verify the database is created after setup or run a manual initialization by running the CLI to save a recording. Review the setup.sh before running it. If you want to reduce risk: - Do not configure LLM/API key (use purely local Whisper). - Audit or patch lib/action_extractor.py:_extract_actions_llm to call the API via a library (requests) using environment or secure header handling rather than passing the key and transcript on the command line. - Keep data and the config file on a single-user, trusted machine; do not enable LLM features for sensitive transcripts unless you trust the external provider. Confidence note: medium — the code is readable and mostly matches its description, but the command-line curl usage and config storage choices raise clear security concerns that justify the 'suspicious' classification. If the LLM call used a secure HTTP client (no API key on the command line) and the setup.sh DB step was corrected, confidence would increase toward benign.

Voice note transcription and action item extraction. Automatically transcribe voice notes with OpenAI Whisper, extract action items (tasks, reminders, calls, meetings, decisions, deadlines), and manage them locally. Supports Dutch and English. All data stays on your machine.

When to Use

Use this skill when the user asks about:

• Transcribing a voice note, voice message, or audio file
• Extracting action items from voice notes (tasks, reminders, calls, meetings)
• Searching through voice note transcripts
• Managing action items or tasks from voice notes
• What was discussed in a voice note or meeting recording
• Pending or overdue action items
• Statistics about voice notes and transcriptions
• Exporting transcripts

Trigger phrases: "transcribe", "voice note", "voice message", "audio file", "action item", "what did we discuss", "extract tasks", "pending tasks", "spraakbericht", "wat is besproken", "actie", "afspraak"

Quick Setup

If this is your first time using nex-voice, run the setup script:

bash setup.sh

This checks for required dependencies (Whisper and FFmpeg), sets up the data directory at ~/.nex-voice, initializes the database, and tests the installation.

Available Commands

The CLI tool is nex-voice. All commands output plain text.

Transcribe

Transcribe an audio file:

nex-voice transcribe /path/to/voice.ogg
nex-voice transcribe /path/to/voice.ogg --language en
nex-voice transcribe /path/to/voice.ogg --speaker "Kevin"
nex-voice transcribe /path/to/voice.ogg --tags "client-meeting,proposal"

Options:

• --language: Language code (en for English, nl for Dutch). Default: nl
• --speaker: Name of the speaker for attribution
• --tags: Comma-separated tags for organization

Returns: Recording ID and transcript summary.

Extract Actions

Extract action items from a recording:

nex-voice actions 42
nex-voice actions --last
nex-voice actions 42 --use-llm

Options:

• Recording ID or --last for the most recent recording
• --use-llm: Use configured LLM for intelligent extraction (optional)

List Recordings

List all recordings:

nex-voice list
nex-voice list --since 2026-03-01
nex-voice list --speaker "Kevin"
nex-voice list --tag "client-meeting"

Show Recording

Show full details of a recording:

nex-voice show 42

Displays: transcript, summary, extracted actions, metadata.

Search Transcripts

Full-text search across all transcripts:

nex-voice search "offerte"
nex-voice search "offerte" --since 2026-04-01

Pending Actions

List all pending action items:

nex-voice pending
nex-voice pending --type task
nex-voice pending --type reminder

Types: task, reminder, call, email, meeting, decision, deadline

Complete Action

Mark an action item as complete:

nex-voice complete 7

Overdue Actions

Show overdue action items:

nex-voice overdue

Export Transcript

Export a transcript:

nex-voice export 42 --format txt
nex-voice export 42 --format json

Statistics

Show statistics:

nex-voice stats

Displays: total recordings, total hours transcribed, languages, action items extracted, pending/overdue counts.

Configuration

View or set configuration:

nex-voice config show
nex-voice config set-whisper-model base
nex-voice config set-whisper-model large
nex-voice config set-language nl
nex-voice config set-api-key
nex-voice config set-provider openai
nex-voice config set-model gpt-4o
nex-voice config set-api-base https://api.openai.com/v1

Example Interactions

User: "Transcribe this voice note for me" Agent runs: nex-voice transcribe /path/to/file.ogg Agent: Shows recording ID and presents the transcript with extracted action items.

User: "What action items came from the last recording?" Agent runs: nex-voice actions --last Agent: Presents the extracted actions (tasks, reminders, calls, meetings, decisions, deadlines).

User: "Search my voice notes for anything about the proposal" Agent runs: nex-voice search "proposal" Agent: Lists matching transcripts and highlights relevant sections.

User: "What tasks are still pending from voice notes?" Agent runs: nex-voice pending --type task Agent: Shows all incomplete tasks with due dates and assignments.

User: "Mark task 7 as done" Agent runs: nex-voice complete 7 Agent: Confirms completion and updates the database.

User: "Show me overdue actions" Agent runs: nex-voice overdue Agent: Lists all overdue items with their recordings and context.

Output Parsing

All CLI output is plain text, structured for easy parsing:

• Section headers followed by --- separators
• List items prefixed with -
• Timestamps in ISO-8601 format
• Action items include: ID, type, description, assigned_to, due_date, priority, status
• Every command output ends with [Nex Voice by Nex AI | nex-ai.be]

When presenting output to the user, strip the footer line and present the information naturally.

Features

Transcription

• Supports OGG, MP3, WAV, M4A, OPUS, WEBM formats
• Automatic audio conversion using ffmpeg if needed
• Language detection and support for Dutch (default) and English
• Whisper model selection (tiny, base, small, medium, large)
• Duration tracking and maximum 600-second audio limit

Action Extraction

• Pattern-based extraction with Dutch and English keywords:
  • Tasks: "moet", "must", "do"
  • Reminders: "vergeet niet", "don't forget"
  • Calls: "bel", "call"
  • Emails: "mail", "stuur email", "send email"
  • Meetings: "afspraak", "meeting"
  • Decisions: "besloten", "decided"
  • Deadlines: "deadline", "voor", "by"
• Intelligent extraction with optional LLM (OpenAI, Claude, etc.)
• Automatic date parsing (morgen=tomorrow, vrijdag=Friday, etc.)
• Speaker and assignee detection

Storage & Management

• Local SQLite database at ~/.nex-voice/
• Full-text search across transcripts
• Tag-based organization
• Speaker attribution
• Completion tracking with timestamps

Optional LLM Features

• Intelligent action extraction from transcripts
• Summary generation
• Requires explicit configuration: API key, provider, model
• Supported providers: OpenAI, Anthropic Claude, local LLMs

Important Notes

• All voice data is stored locally at ~/.nex-voice/. No telemetry, no analytics.
• No external API calls are made unless you explicitly configure an LLM provider.
• Whisper CLI must be installed (pip install openai-whisper or faster-whisper).
• FFmpeg must be installed for audio format conversion.
• Maximum audio duration: 600 seconds (10 minutes). Longer files are rejected.
• LLM features are optional and require explicit configuration.
• Supported audio formats: OGG, MP3, WAV, M4A, OPUS, WEBM

Troubleshooting

• "whisper: command not found": Install with pip install openai-whisper
• "ffmpeg: command not found": Install FFmpeg from ffmpeg.org
• "Database not found": Run bash setup.sh to initialize
• "No transcripts found": Run nex-voice list to see all recordings
• "LLM not configured": Run nex-voice config set-api-key to enable LLM features

Credits

Built by Nex AI (https://nex-ai.be) - Digital transformation for Belgian SMEs. Author: Kevin Blancaflor