AssemblyAI advanced speech transcription

AdvisoryAudited by Static analysis on May 10, 2026.

Overview

Detected: suspicious.env_credential_access

Findings (1)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

NoteHigh Confidence

ASI03: Identity and Privilege Abuse

What this means

The skill can use your AssemblyAI account quota and access transcript jobs available to that API key.

Why it was flagged

The CLI uses an AssemblyAI API key from an environment variable or flag to authenticate provider requests, which is expected for this service integration.

Skill content

const apiKey = String(flags['api-key'] ?? process.env.ASSEMBLYAI_API_KEY ?? '');

Recommendation

Use a scoped AssemblyAI key where possible, keep it in the environment rather than prompts, and revoke or rotate it if exposed.

NoteHigh Confidence

ASI07: Insecure Inter-Agent Communication

What this means

Private meeting or media content may leave the local machine and be processed by AssemblyAI services.

Why it was flagged

Transcript text may be sent to AssemblyAI's LLM Gateway for summaries or structured extraction, which is disclosed and aligned with the skill purpose.

Skill content

This skill therefore prepares transcript text and sends it to: - `https://llm-gateway.assemblyai.com/v1/chat/completions`

Recommendation

Only process audio, video, and transcripts you are allowed to send to AssemblyAI, and review prompts, schemas, and output files for sensitive information.

NoteHigh Confidence

ASI02: Tool Misuse and Exploitation

What this means

If used carelessly, an agent or user could send broader-than-intended request bodies or parameters to the provider.

Why it was flagged

Raw provider request passthroughs are explicitly documented and useful for advanced AssemblyAI parameters, but they bypass the safer predefined workflows.

Skill content

This skill deliberately exposes raw passthrough options: - `--config` for transcription requests - `--understanding-request` for speech understanding - `--request` for LLM Gateway chat completions

Recommendation

Prefer the documented default commands unless you need a specific AssemblyAI parameter, and review any raw JSON request before sending it.

NoteMedium Confidence

ASI04: Agentic Supply Chain Vulnerabilities

What this means

Users have less provenance information for deciding whether the bundled Node script is the intended implementation.

Why it was flagged

The registry metadata does not identify a source repository or homepage, although the skill includes bundled code and references AssemblyAI documentation in SKILL.md.

Skill content

Source: unknown; Homepage: none

Recommendation

Install only from a trusted registry entry and review the bundled script before using it with sensitive media or production credentials.

Findings (1)

critical

suspicious.env_credential_access

Location: scripts/assemblyai.mjs:23
Finding: Environment variable access combined with network send.