HN Podcast Transcribe
AdvisoryAudited by Static analysis on May 11, 2026.
Overview
No suspicious patterns detected.
Findings (0)
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
Installing and running the skill may download third-party packages and Whisper model files onto the local machine.
The skill depends on third-party packages and model downloads that are not pinned by an install spec. This is common for this type of local transcription workflow, but users should be aware of the external supply-chain trust involved.
`pip install openai-whisper`, `pip install requests`, `pip install static-ffmpeg`, `yt-dlp` ... `Whisper models auto-download to ~/.cache/whisper`
Install in an isolated Python environment, use trusted package sources, and pin versions if reproducibility or stricter supply-chain control is needed.
If direct download fails, the fallback may fetch audio using weaker TLS verification, which could increase exposure to tampered or unintended downloads on untrusted networks.
The optional fallback downloader invokes yt-dlp and disables certificate checks. This is purpose-aligned for podcast downloading, but weakens normal download trust if the fallback path is used.
["yt-dlp", "--no-check-certificates", "-f", "bestaudio", "--extractor-args", "generic:impersonate", "-o", str(dest), url]
Use trusted RSS feeds and networks; consider manual download or removing `--no-check-certificates` if that fallback is not necessary.
If configured, the skill can continue running daily until the cron job is removed, consuming network, disk, and CPU resources.
The skill documents an optional recurring OpenClaw cron job. This is disclosed and scoped to the podcast pipeline, but it creates ongoing automated activity if the user enables it.
cron add --name "hn-podcast-digest" --schedule "0 6 * * *" --payload '{"kind":"agentTurn","message":"Run the HN podcast transcription pipeline: python3 scripts/pipeline.py --limit 3"}'Only add the cron job if recurring processing is desired, keep a limit such as `--limit 3`, and know how to disable the schedule.
Transcribed content persists on disk and can be searched later from the archive directory.
The skill intentionally creates a persistent local archive and search index of transcripts. This is central to the skill’s purpose, but private or sensitive podcast feeds would remain stored and searchable locally.
Creates `archive_index.json` ... Full-text search across all transcribed episodes ... `transcript.txt`
Use a non-sensitive archive location, protect or delete transcripts when no longer needed, and avoid using private feeds unless local storage is acceptable.