TencentCloud ASR

Plain-language considerations before installing or using this skill: - The skill actually needs your Tencent Cloud credentials (TENCENTCLOUD_SECRET_ID and TENCENTCLOUD_SECRET_KEY, and sometimes TENCENTCLOUD_APPID) even though the registry metadata says none — do not paste secrets into group chat; prefer configuring them locally or providing them only in a secure, private channel. - At runtime the skill may auto-install software: it can call system package managers (apt/dnf/yum/zypper/brew/winget/choco, possibly with sudo) to install ffmpeg/ffprobe and will pip-install the tencentcloud SDK. That means it can modify the host system and requires network access. Only run it on machines where you accept those changes (e.g., disposable VM, container, or developer machine), or inspect and run the scripts manually yourself. - The code references and may read host file paths (e.g., QQ Bot downloads directory) for integrations — if you don't want that, don't enable the QQ Bot integration or run the skill in an isolated environment. - The SKILL.md includes helpful security guidance (prefer temporary env injection, don't write keys to shell profiles), but some reference docs also show how to persist keys. Decide your preferred credential handling policy and enforce it (temporary env vs. persistent profile). - If you are not comfortable with automated package installs, review the scripts (ensure_ffmpeg.py, file_recognize.py, etc.) and run them manually under supervision, or set up ffmpeg and the Python SDK yourself before invoking the skill. What would increase my confidence: updated registry metadata that correctly lists required environment variables/primary credential and an explicit install manifest or an option to disable autonomous installation. If those aren’t provided, treat this skill as requiring elevated trust and run it only in an isolated environment.