Automatically extracts audio from video, transcribes it using qwen3-asr-flash, and generates segmented text summaries saved alongside the original file.

This skill appears to implement its advertised audio-extraction and transcription functionality, but it contains a hard-coded API key and sends full Base64-encoded audio to an undocumented third-party endpoint (dashscope.aliyuncs.com). Before installing or running it: (1) Do not run it on private/confidential audio as it will transmit the entire audio to that endpoint. (2) Ask the author to remove the embedded API key and require the user to supply their own key via an environment variable or secure config. (3) Verify the identity/trustworthiness of the endpoint (dashscope.aliyuncs.com) and the ASR provider (qwen3-asr-flash). (4) Prefer a version that documents required env vars and exposes the network destination; optionally modify the script to point to a trusted API host or your own account. If you cannot verify the endpoint or the provenance of the embedded key, treat this skill as high-risk and avoid using it with sensitive data.

Type: OpenClaw Skill Name: audio-summary Version: 1.0.0 The skill contains a hardcoded Aliyun DashScope API key in 'audio_summary_skill.py', which is a significant security risk and credential leak. Additionally, the script is vulnerable to shell injection because it uses an f-string to construct an 'os.system' command with the 'video_path' input without proper sanitization. While these represent critical security vulnerabilities (RCE and credential exposure), they appear to be unintentional flaws rather than intentional malware designed for exfiltration or persistence.