speech2text

Automatically converts speech messages in ogg/wav/mp3/m4a formats to text using offline Faster-Whisper with ffmpeg format conversion.

This skill appears to do what it says (convert audio to text using faster-whisper + ffmpeg) but has a few important caveats to consider before installing: - Offline claim: The SKILL.md says 'offline' but the code calls WhisperModel(MODEL_SIZE) without bundled weights; faster-whisper will typically fetch model weights from the network if they are not already available locally. If you must avoid network/model downloads, preinstall model files and verify the model is loaded offline. - Local file scanning: If no attachment is provided the skill will scan ~/.openclaw/media/inbound and pick the newest .ogg file. If you have sensitive audio in that location, the skill may read it. If you do not want that behavior, either avoid allowing automatic triggers or modify the code to require explicit attachments. - Platform assumptions: The code only checks Windows ffmpeg paths (ffmpeg.exe) and SKILL.md shows a Windows installation path. On Linux/macOS the skill may not find ffmpeg without adjustments. - Dependencies: You must pip install faster-whisper and pydub and have ffmpeg available. Model downloads may consume bandwidth and disk space. Recommendations: - Review the code (included) and, if you need true offline operation, predownload/install the chosen Whisper model and test model loading without network access. - Run the skill in a sandbox or environment where reading ~/.openclaw/media/inbound is acceptable, or patch the code to require explicit attachments only. - Verify ffmpeg is installed on your OS and adapt the ffmpeg path logic for non-Windows systems. - If unsure, treat this as potentially privacy-sensitive and avoid enabling automatic triggers until you validate its behavior.

Type: OpenClaw Skill Name: speech2text Version: 1.0.0 The speech2text skill implements local audio transcription using the faster-whisper library and ffmpeg. The code in __init__.py safely handles audio conversion via subprocess.run using argument lists (preventing shell injection) and restricts file access to the expected OpenClaw media directory (~/.openclaw/media/inbound). No evidence of data exfiltration, malicious command execution, or prompt injection was found; the skill's behavior aligns strictly with its documented purpose.