High-performance audio transcription and analysis using Gemini 3.1 Pro. Powered by Evolink.ai

This skill appears to implement cloud transcription via Evolink (sending audio data to https://api.evolink.ai), which is consistent with its description — but take these precautions before installing: - Expect to provide EVOLINK_API_KEY; do not supply high-privilege or unrelated secrets. The registry metadata appears to omit this requirement — assume the key is required. - The transcribe script will upload the entire audio file to Evolink. Do not use it with sensitive audio unless you accept sending that data to an external service and have verified Evolink's privacy/security posture. - translate_readme.py will call the same API to translate and will overwrite README.<lang>.md files in the workspace. If you don't want repository content sent or overwritten, do not run that script or inspect/modify it first. - If you need assurance, request clarification from the publisher (EvoLinkAI) and ask them to fix the metadata inconsistency and to document/remove translate_readme.py or make it opt-in. Run the skill in an isolated environment or container and inspect network traffic if you must verify behavior.

Type: OpenClaw Skill Name: audio-analyze Version: 1.0.7 The script 'scripts/transcribe.sh' contains a command injection vulnerability because it directly interpolates the shell variable '$FILE' into a Python command string executed via 'python3 -c'. A specially crafted filename could allow arbitrary Python code execution. While the skill's primary function of sending audio data to 'api.evolink.ai' aligns with its stated purpose, the lack of input sanitization in the execution script poses a significant security risk.