Openai Whisper

Local speech-to-text with the Whisper CLI (no API key).

Security Scan

The skill is internally consistent: it provides instructions to run a local Whisper CLI, only requires the 'whisper' binary and a Homebrew install; the main risks are model downloads to disk and trusting the Homebrew formula source.

Purpose & Capability

Name/description (local speech-to-text) match the requirements and instructions: the skill only needs a 'whisper' CLI and shows local transcription commands. Nothing requested appears unrelated to the stated purpose.

Instruction Scope

SKILL.md only instructs running the local 'whisper' binary against local audio files. It does mention that models will be downloaded to ~/.cache/whisper on first run — which implies network activity and persistent storage of model files (large disk usage). This is expected for a local model CLI but is worth noting.

Install Mechanism

Install uses a Homebrew formula (openai-whisper) which is a low-to-moderate risk install mechanism. The manifest does not specify the tap or source repository for the formula; Homebrew formulas are usually safe but you should verify the formula's origin before installing to avoid pulling an untrusted binary.

Credentials

The skill requests no environment variables, credentials, or config paths — proportional to a local CLI STT tool.

Persistence & Privilege

Skill is not marked 'always' and does not request persistent system-wide privileges. Its persistent effect is limited to installing a binary and the CLI's own model cache (~/.cache/whisper).

Assessment

This skill appears to do what it says: run a local Whisper CLI to transcribe audio. Before installing, verify the Homebrew formula source (run 'brew info/openai-whisper' or inspect the formula) to ensure you're installing an official/trusted package. Be aware that the first run will download model files to ~/.cache/whisper (potentially large and requiring network access); if you need stronger isolation, consider installing in a container or VM. After installation, check 'which whisper' and review 'whisper --help' or the formula contents to confirm there are no unexpected network callbacks or telemetry. If you require guaranteed offline behavior or strict provenance, obtain models and the CLI from an auditable upstream source.

Whisper (CLI)

Use whisper to transcribe audio locally.

Quick start

• whisper /path/audio.mp3 --model medium --output_format txt --output_dir .
• whisper /path/audio.m4a --task translate --output_format srt

Notes

• Models download to ~/.cache/whisper on first run.
• --model defaults to turbo on this install.
• Use smaller models for speed, larger for accuracy.