Super-Transcribe — Unified Speech-to-Text

Unified speech-to-text skill. Use when the user asks to transcribe audio or video, generate subtitles, identify speakers, translate speech, search transcript...

This skill appears coherent with its stated purpose, but note the following before installing or running: (1) It will create per-backend virtual environments and perform pip installs and model downloads on first use — expect large (GB-scale) downloads for Parakeet/NeMo and PyTorch with CUDA. (2) The shared helper can run pip using the current Python interpreter; to avoid installing packages system-wide, run the tool inside an isolated environment (container, dedicated user, or a directory where venv creation is allowed) or review and run the setup scripts manually. (3) Speaker diarization may require a HuggingFace token at ~/.cache/huggingface/token; the skill will check for that file but does not require it unless you request diarization. (4) The tool uses ffmpeg and yt-dlp for media conversion and URL downloads — only install those if you need URL input or non-wav formats. Recommended steps: run ./scripts/transcribe --check (or the provided setup.sh --check) to preview what would be installed, use the lean-install option if bandwidth is limited, and inspect the setup.sh and auto-install helper if you prefer to perform installations manually or inside a controlled environment.

Type: OpenClaw Skill Name: super-transcribe Version: 1.0.2 The OpenClaw AgentSkills skill bundle 'super-transcribe' is classified as benign. All code and documentation align with its stated purpose of providing unified speech-to-text transcription. The `SKILL.md` provides clear, responsible instructions for the AI agent, emphasizing cautious handling of user requests and avoiding unnecessary actions. Python scripts (`transcribe.py` in both backends) and setup scripts (`setup.sh`) utilize standard tools like `ffmpeg`, `yt-dlp`, `pip`, and `uv` for audio processing, URL downloads, and dependency management. While these tools involve system command execution and network access, they are used for legitimate functions, and arguments are passed in a way that mitigates direct shell injection risks. The mention of `~/.cache/huggingface/token` is for legitimate authentication with HuggingFace models (e.g., for diarization) and does not indicate credential theft. No evidence of data exfiltration, persistence mechanisms, obfuscation, or other malicious intent was found.