Doubao Asr

• Analyzed: May 11, 2026, 4:43 AM
• Findings: 1
• Version: 0.18.3
• Hash: 29771c4839410fe84dfb4fdff0549c6e0a3b687aedd2b2bf5ea882179ac126c2
• Source: palm
• External report: View on VirusTotal

Findings (1)

The doubao-asr skill is a legitimate tool for transcribing audio files using ByteDance's Volcengine API. The Python script (transcribe.py) implements standard API interactions, including secure V4 signing for temporary file uploads to Volcengine TOS and basic path validation to prevent unauthorized file writes. The SKILL.md instructions are highly detailed and specifically emphasize security best practices, such as using least-privilege IAM policies instead of broad permissions.