Local Whisper

Free local speech-to-text for Telegram and WhatsApp using MLX Whisper on Apple Silicon. Private, no API costs.

This skill appears to be what it claims: a local, Apple Silicon-optimized Whisper daemon and CLI. Before installing, consider the following: (1) The package will run a local HTTP daemon on 127.0.0.1:8787 — only allow trusted local callers (OpenClaw is intended), and be cautious about other local apps talking to that port. (2) The daemon accepts a JSON field containing a filesystem path and will open that path for transcription; ensure only trusted processes can instruct the daemon to avoid accidental processing of unintended files. (3) requirements.txt includes OpenAI and Groq client libraries; if you have OPENAI_API_KEY or GROQ_API_KEY set in your environment (or in a loaded .env), the code can use cloud backends — remove those env vars or avoid installing those packages if you require strict local-only operation. (4) Install via pip installs third-party packages from PyPI — review requirements.txt and consider using a virtualenv or isolated account. (5) If you want automatic startup, inspect the LaunchAgent plist before copying it into ~/Library/LaunchAgents. Overall this skill is coherent with its stated purpose, but take the above precautions if your threat model requires strict local-only privacy.

Type: OpenClaw Skill Name: whisper-mlx-local Version: 1.5.0 The skill provides local speech-to-text transcription using MLX Whisper, with optional cloud API fallbacks. All observed behaviors, including the use of `launchctl` for daemon persistence (documented in SKILL.md and README.md), local network communication via `curl` to `localhost:8787` (scripts/transcribe.sh), and optional external API calls to OpenAI/Groq (scripts/transcriber.py) for transcription, are clearly aligned with its stated purpose. There is no evidence of data exfiltration to unauthorized endpoints, malicious execution, obfuscation, or prompt injection attempts against the agent.