SenseVoice Transcribe

Transcribe audio files (WAV/MP3/M4A/FLAC) to timestamped text using SenseVoice-Small + FSMN-VAD. Supports single-file and batch mode with VAD-anchored per-se...

This skill appears coherent for local batch transcription. Before running: (1) review and run it inside an isolated venv as documented; (2) confirm the script will be pointed at the correct daylog directory (it writes to and may delete files there with --force-dates); (3) only supply a Discord webhook URL you control — the webhook is optional and would allow the script to send status messages; (4) be aware models (~234MB + VAD) will be downloaded from ModelScope on first run and that the script will write progress files where you point PROGRESS_FILE; (5) back up any existing transcripts before using --force-dates. If you want extra assurance, inspect the full script run (stdout/logs) during a dry-run and search the file for any additional network calls or subprocess usage not covered in the visible code.

Type: OpenClaw Skill Name: sensevoice-transcribe Version: 1.0.0 The skill provides legitimate audio transcription functionality but contains a significant security vulnerability in `scripts/batch_transcribe.py`. The `--force-dates` command-line argument is used to construct file paths for directory deletion via `shutil.rmtree` without any sanitization or validation, which allows for path traversal and arbitrary directory deletion. While the script's features (such as Discord webhook notifications and batch processing) align with its stated purpose, the lack of input handling in a file-deletion routine poses a high risk if the OpenClaw agent is manipulated into passing malicious strings.