Voice To Protocol Transcriber

Record experimental procedures and observations via voice commands during lab work. Real-time transcription for structured experiment documentation.

What to check before installing: - Dependency mismatch: SKILL.md asks you to install speechrecognition, pyaudio, pydub, python-docx but requirements.txt does not include them. Expect to manually install the missing packages (use a virtualenv). Verify the skill runs after installing exactly what it needs. - Network/privacy risk: The speechrecognition library typically uses online services by default (for example, Google Web Speech API). Confirm whether the code uses an offline recognizer or sends audio to external servers. If the code calls cloud recognizers, audio (potentially sensitive experimental data) may leave your machine. Ask the author or inspect the full main.py to see how Recognition is configured. - Inspect the rest of main.py: only a truncated portion was provided. Review the remainder for any hard-coded endpoints, hidden subprocess/network calls, or unexpected file access before trusting this in regulated labs. - Install safely: install inside a virtual environment on a non-production/test machine first. Run with microphone permissions in an isolated environment. Check that saved files go to a directory you control and do not inadvertently overwrite other files. - Operational caution: don't run this against sensitive or PHI-containing experiments until you confirm where audio/text is processed (locally vs. remote) and audit third-party dependencies. If you can provide the full main.py (untruncated) or confirm whether speech recognition is configured for an offline engine, I can raise or lower the confidence and give more specific advice.

Type: OpenClaw Skill Name: voice-to-protocol-transcriber Version: 0.1.0 The skill contains a path traversal vulnerability in `scripts/main.py`, where the `experiment_name` input is used to construct file paths without sanitizing directory traversal sequences (e.g., `../`), potentially allowing files to be written outside the intended directory. Additionally, there is a significant discrepancy between `SKILL.md`, which claims to support real-time voice recognition and requires external libraries like `pyaudio`, and the actual implementation in `scripts/main.py`, which is a basic text-only logger using standard libraries. While no clear evidence of malicious intent was found, the combination of a file-writing vulnerability and misleading documentation warrants a suspicious classification.