Whisper Voice Transcription (whisper.cpp)

Build and use whisper.cpp for local speech-to-text workflows, with optional cloud fallback when local transcription is not practical.

Security Scan

The skill is an instruction-only guide to building and running whisper.cpp locally and its requirements and instructions are consistent with that purpose.

Purpose & Capability

Name and description match the SKILL.md: instructions show how to clone, build, and run whisper.cpp locally and describe optional cloud fallback. No unrelated credentials, binaries, or config paths are requested.

Instruction Scope

Overall instructions stay within the stated purpose (build/run local STT, optional cloud fallback). The fallback guidance to "locate the exact cache or upload path used by that tool" is vague and could lead an agent to read user files if implemented broadly; the doc does warn to restrict searches to expected app cache directories, but an implementer should be explicit about which paths are safe to access.

Install Mechanism

Instruction-only skill (no install spec). Build instructions clone the official ggerganov/whisper.cpp repo and build locally with cmake — this is expected and proportionate. No downloads from unknown/shortened/personal URLs or archive extraction steps are included.

Credentials

No environment variables or credentials are requested. Network access is implied for cloning and model download (GitHub/Hugging Face) but that is appropriate for the described functionality. If using Hugging Face private models or certain cloud APIs, additional creds would be reasonable but none are declared here.

Persistence & Privilege

Skill does not request persistent/always-on presence and does not modify other skills or system-wide settings. It is user-invocable and uses normal agent autonomy settings.

Assessment

This is an operator guide for building and running whisper.cpp and is coherent with its stated purpose. Before installing or following the guide: (1) verify you are cloning the correct upstream repository and, when downloading model files, prefer official release artifacts and verify checksums; (2) be cautious implementing any automated "search cache" fallback — restrict searches to known application cache paths and avoid broad home-directory scans; (3) explicitly prompt the user before sending audio to any cloud provider and confirm which API/endpoint will be used; (4) note that building from source requires developer tools (git, cmake, compiler, ffmpeg) and network access to fetch models. If you need the skill to operate autonomously, consider adding strict path whitelists and user consent prompts to reduce accidental data exposure.

Whisper Voice Transcription with whisper.cpp

When to use

• You want local speech-to-text without sending audio to a third party.
• You need a fallback workflow when a built-in transcription tool fails.
• You want an operator guide for compiling and running whisper.cpp.

Prerequisites

• git
• cmake
• a C or C++ compiler
• ffmpeg

Build steps

git clone --depth 1 https://github.com/ggerganov/whisper.cpp.git ~/whisper.cpp
cd ~/whisper.cpp
cmake -B build -DCMAKE_BUILD_TYPE=Release
cmake --build build -j4

Download a model from the official ggerganov/whisper.cpp releases or Hugging Face repository and place it under ~/whisper.cpp/models/.

Standard transcription flow

ffmpeg -y -i input_audio.ogg -ar 16000 -ac 1 -f wav /tmp/voice.wav
~/whisper.cpp/build/bin/whisper-cli \
  -m ~/whisper.cpp/models/ggml-large-v3.bin \
  -f /tmp/voice.wav \
  -l auto \
  --no-timestamps

Fallback workflow

If a higher-level tool fails, first locate the exact cache or upload path used by that tool. Search only within the expected application cache directory instead of scanning the entire home directory.

Cloud fallback

If local transcription is too slow or unavailable, use an approved speech API and tell the user that audio will leave the machine.

Guardrails

• Download binaries and models only from official sources.
• Verify hashes when possible.
• Do not search unrelated directories for audio files.
• Be explicit when using a cloud provider because that changes the privacy model.