Skill flagged — suspicious patterns detected
ClawHub Security flagged this skill as suspicious. Review the scan results before using.
mlx-whisper
v1.0.7Set up mlx-whisper as the local audio transcription engine for OpenClaw on Apple Silicon Macs (M1/M2/M3/M4). Automatically transcribes voice notes sent via T...
⭐ 0· 249·1 current·1 all-time
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Suspicious
medium confidencePurpose & Capability
The name, description, and requested binaries (python3, pip3) align with installing a local Python-based transcription tool. However, SKILL.md repeatedly instructs you to copy a wrapper script from this skill (bin/mlx-whisper-transcribe.sh), but the file manifest does not include a bin directory or that script. That inconsistency is unexplained and disproportionate to the stated purpose.
Instruction Scope
Most runtime steps are in-scope (pip3 install mlx-whisper, configure openclaw.json, restart). The instructions ask you to copy a shell wrapper into your user bin and run it; because the wrapper script is not included in the package, you cannot inspect or verify what that script does. Installing and running an unanudited script is a risk. Otherwise the instructions do not request unrelated files, secrets, or external endpoints beyond model downloads from typical Hugging Face caching.
Install Mechanism
Installation is via pip3 (pip3 install mlx-whisper) which is expected for a Python package and uses public package registries; this is a common but moderately privileged operation because pip packages can run install-time code. There are no downloads from obscure URLs in the instructions.
Credentials
The skill requires only python3/pip3 and asks you to edit OpenClaw's config (~/.openclaw/openclaw.json) and to allow model downloads to the Hugging Face cache (~/.cache/huggingface). It does not request credentials or unrelated environment variables. These requirements are proportionate to the stated transcription purpose.
Persistence & Privilege
always is false and the skill does not request permanent platform-wide privileges. It instructs you to modify your OpenClaw config and restart the app, which is expected for adding a local tool. It does not ask to modify other skills or system-wide settings beyond the user config.
What to consider before installing
Do not copy or run any wrapper script you cannot inspect. The SKILL.md tells you to copy bin/mlx-whisper-transcribe.sh from the skill, but that file is not included in the published package — ask the publisher to provide the script source or include it in the skill so you can audit it. If you still want to proceed: 1) install mlx-whisper in a contained environment (virtualenv or user-only pip install) so install hooks are isolated; 2) verify what files pip installed (pip3 show -f mlx-whisper and inspect installed scripts); 3) if you must use a wrapper, write your own small wrapper that calls the mlx_whisper Python API or runs a short vetted command rather than copying an opaque shell script; 4) confirm model downloads will fit your disk (~465MB or more for larger models) and that cached models live under ~/.cache/huggingface; 5) only grant OpenClaw the configuration changes you understand and back up ~/.openclaw/openclaw.json before editing. If the publisher cannot produce the wrapper script source or explain why it was omitted, treat the skill as untrusted.Like a lobster shell, security has layers — review code before you run it.
latestvk9714wztf1jv87xvyvgp5mdxh582n73n
License
MIT-0
Free to use, modify, and redistribute. No attribution required.
Runtime requirements
🎙️ Clawdis
OSmacOS
Binspython3, pip3