Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

Ntriq X402 Audio Intel

v1.0.0

AI audio transcription — speech-to-text for mp3/wav/m4a/ogg. Language auto-detection, timestamps. $0.05 USDC via x402.

0· 69·1 current·1 all-time
byntriq@ntriq-gh

Install

OpenClaw Prompt Flow

Install with OpenClaw

Best for remote or guided setup. Copy the exact prompt, then paste it into OpenClaw for ntriq-gh/ntriq-x402-audio-intel.

Previewing Install & Setup.
Prompt PreviewInstall & Setup
Install the skill "Ntriq X402 Audio Intel" (ntriq-gh/ntriq-x402-audio-intel) from ClawHub.
Skill page: https://clawhub.ai/ntriq-gh/ntriq-x402-audio-intel
Keep the work scoped to this skill only.
After install, inspect the skill metadata and help me finish setup.
Use only the metadata you can verify from ClawHub; do not invent missing requirements.
Ask before making any broader environment changes.

Command Line

CLI Commands

Use the direct CLI path if you want to install manually and keep every step visible.

OpenClaw CLI

Bare skill slug

openclaw skills install ntriq-x402-audio-intel

ClawHub CLI

Package manager switcher

npx clawhub@latest install ntriq-x402-audio-intel
Security Scan
Capability signals
CryptoCan make purchases
These labels describe what authority the skill may exercise. They are separate from suspicious or malicious moderation verdicts.
VirusTotalVirusTotal
Benign
View report →
OpenClawOpenClaw
Suspicious
high confidence
!
Purpose & Capability
Name/description claim a transcription service and the instructions call a remote API endpoint (https://x402.ntriq.co.kr/audio-intel) which is coherent with the stated purpose, but the SKILL.md also states "100% local inference on Mac Mini," which contradicts the explicit remote POST-based workflow. That contradiction is unexplained and may be misleading.
!
Instruction Scope
Runtime instructions tell the agent to POST audio_url or audio_base64 to the remote endpoint and include an X-PAYMENT header. This is within scope for a hosted transcription service, but it instructs sending potentially sensitive audio to an external host and does not document where or how the X-PAYMENT token is obtained, stored, or scoped. There is no guidance on validating URLs or handling private audio, increasing exfiltration risk if used carelessly.
Install Mechanism
Instruction-only skill with no install spec or code files. No binaries or installers are written to disk, which minimizes installation risk.
!
Credentials
requires.env is empty and no primary credential is declared, yet the SKILL.md explicitly requires an X-PAYMENT header ("<x402-payment-header>") to call the API and mentions on-chain USDC payment. The skill fails to declare any environment variable or secret where that payment credential would live, and gives no instructions about signing/obtaining a payment token or wallet access. This mismatch between declared and actual required credentials is disproportionate and unexplained.
Persistence & Privilege
The skill does not request always:true and has no install-time or persistent agent modifications. It does not request elevated platform presence.
What to consider before installing
This skill appears to be a hosted transcription API — it will send audio you provide to https://x402.ntriq.co.kr and requires a payment header (X-PAYMENT) even though no env vars or credentials are declared. Before installing or using it: 1) Ask the publisher to clarify the contradictory "local inference" claim versus the remote POST flow. 2) Ask how to obtain and supply the X-PAYMENT token securely (should be declared as a required credential or env var and scoped). 3) Consider privacy: do not send sensitive or private audio until you confirm retention, logging, and data handling policies. 4) Test with non-sensitive audio and a dummy payment header first. If the publisher cannot explain the payment flow and the local vs remote contradiction, treat the skill as untrusted.

Like a lobster shell, security has layers — review code before you run it.

latestvk97e3bjtf2h9w19b7t2f5jsv2584y8ww
69downloads
0stars
1versions
Updated 1w ago
v1.0.0
MIT-0

Audio Intel (x402)

Transcribe audio files to text using Whisper AI. Supports mp3, wav, m4a, ogg, flac. Auto-detects language. Returns full text, timestamps, and per-segment breakdown. 100% local inference on Mac Mini. $0.05 USDC per call.

How to Call

POST https://x402.ntriq.co.kr/audio-intel
Content-Type: application/json
X-PAYMENT: <x402-payment-header>

{
  "audio_url": "https://example.com/speech.mp3"
}

Parameters

ParameterTypeRequiredDescription
audio_urlstring✅ (or base64)URL of audio file (mp3/wav/m4a/ogg/flac)
audio_base64string✅ (or url)Base64-encoded audio
languagestringForce language (e.g. en, ko, ja). Default: auto-detect

Example Response

{
  "status": "ok",
  "text": "Hello, this is a test recording for transcription.",
  "language": "en",
  "language_probability": 0.998,
  "duration": 4.32,
  "segments": [
    {"start": 0.0, "end": 4.32, "text": "Hello, this is a test recording for transcription."}
  ]
}

Payment

  • Price: $0.05 USDC per call
  • Network: Base mainnet (EIP-3009 gasless)
  • Protocol: x402
curl https://x402.ntriq.co.kr/services

Comments

Loading comments...