Volcengine STT

Transcribe audio to text using Volcano Engine (Volcengine/ARK) speech-to-text APIs. Use when the user wants to replace Whisper/OpenAI STT with Volcengine, tr...

Do not assume this skill uses Volcengine/ARK based on its name or SKILL.md. The bundled script actually uploads audio to openspeech.bytedance.com and expects VOLC_APP_ID / VOLC_ACCESS_TOKEN (or reads ~/.openclaw/openclaw.json) — a mismatch that may be accidental or intentional. Before installing: 1) Ask the publisher which provider the skill is intended for and request corrected docs or code. 2) If you must test it, run the script in a sandbox or isolated account and with non-sensitive test audio. 3) Don't provide production credentials until the provider/credential mapping is clarified; if you already supplied keys, consider rotating them. 4) If you expect Volcengine/ARK, either obtain a version that actually calls the ARK endpoints or modify the script accordingly. 5) Be aware the script transmits local audio and may read OpenClaw config for secrets — only run it where you trust that destination and have reviewed the code.

Type: OpenClaw Skill Name: volcengine-stt Version: 0.2.1 The skill is designed for transcribing audio to text using Volcengine/ByteDance APIs, a legitimate function. The `SKILL.md` provides clear instructions without any prompt injection attempts. The `transcribe.sh` script uses standard tools (`curl`, `jq`, `base64`) safely, handles API keys from environment variables or `~/.openclaw/openclaw.json` securely via HTTP headers, and connects to legitimate Volcengine/ByteDance API endpoints (e.g., `https://openspeech.bytedance.com/api/v3/auc/bigmodel/`). There is no evidence of malicious intent such as data exfiltration, unauthorized execution, persistence mechanisms, or obfuscation. The script's use of `jq -n --arg` for constructing JSON payloads mitigates injection risks.