Qqbot Voice Transcribe

QQ Bot 语音消息自动识别 v2.0。自动解码 QQ Silk V3 格式，Whisper medium 模型识别，Gateway 集成，用户确认流程。

This skill appears to do what it says: decode QQ Silk V3 files and transcribe them with Whisper. Before installing or running it: (1) review the silk-v3-decoder repository (converter.sh/decoder) before executing it locally, (2) be prepared to install system packages (ffmpeg, python/pip) and the 'whisper' CLI; these steps may require sudo and can modify /etc/fstab if you follow the swapfile instructions, (3) running Whisper medium uses significant CPU/memory — prefer smaller models or a dedicated machine, (4) the skill executes shell commands (converter, ffmpeg, whisper) on files you provide — validate/limit which attachments you auto-process to avoid processing attacker-supplied payloads, and (5) do not run these instructions as root on sensitive hosts unless you trust the external decoder repo and understand the system changes. If you want higher assurance, run the pipeline in an isolated environment (container/VM) and audit the cloned decoder code first.

Type: OpenClaw Skill Name: qqbot-voice-transcribe Version: 1.0.0 The skill bundle provides a utility for transcribing QQ voice messages but contains significant security vulnerabilities and high-risk instructions. The integration examples (e.g., `gateway-integration-v2.ts`) and Python scripts (`process_qq_voice.py`) use `child_process.exec` and `subprocess.run` with unsanitized file paths derived from external attachments, creating a high risk of Remote Code Execution (RCE) via shell injection. Additionally, the documentation (`README.md`) instructs the user or agent to perform high-privilege system modifications, such as creating a swap file and editing `/etc/fstab`. While these actions are plausibly intended to support resource-intensive Whisper models, the lack of input validation and the promotion of insecure coding practices make the bundle dangerous to deploy without significant modification.