使用科大讯飞 API 将音频/视频转换为文字。支持本地音频文件转录、YouTube 视频下载并转文字。适用于会议记录、视频字幕、语音笔记等场景。当用户需要语音转文字、音频转录、YouTube 视频转文字时触发。

What to check before installing 1) Metadata mismatch: The registry entry says no credentials or required binaries, but the code and SKILL.md require three XFYUN credentials and the yt-dlp/ffprobe binaries. Treat the metadata omission as a red flag—confirm the author/source before proceeding. 2) Audio upload / privacy: The scripts upload entire audio files to an external API (BASE_URL=https://office-api-ist-dx.iflyaisol.com). This is expected for a cloud ASR, but you should only transcribe audio you are comfortable uploading. Verify the endpoint is an official iFlytek domain and check the vendor's privacy/retention policy if you have sensitive audio. 3) TLS bypass in downloads: The yt-dlp commands include --no-check-certificates. This disables certificate verification for downloads and can expose you to MITM attacks when downloading audio. Consider removing that flag or running yt-dlp without it. 4) Required local binaries: Ensure yt-dlp and ffprobe (from ffmpeg) are installed and come from trusted sources. The code falls back to a filesize-based duration estimate if ffprobe is missing, but accurate duration detection relies on ffprobe. 5) Secrets handling: The install scripts copy .env.example to .env; do not commit or share .env. Inspect the code to ensure no hardcoded keys are present (the package appears to follow that guideline). 6) Source trust: The skill owner and homepage are unknown. If you do not trust the source, run the scripts in an isolated VM/container, audit network endpoints, or prefer an offline transcription alternative (e.g., local Whisper) for sensitive content. If you decide to proceed: inspect/validate BASE_URL (DNS/ownership), remove/avoid --no-check-certificates, supply credentials only in a local .env, and run first with non-sensitive test audio.

Type: OpenClaw Skill Name: iflytek-asr Version: 1.0.0 The skill bundle provides legitimate functionality for transcribing audio and downloading YouTube videos using the iFlytek (iFLYTEK) API and yt-dlp. The implementation in scripts like speech_to_text.py and download_audio.py aligns with the stated purpose, using standard libraries (requests, subprocess) for API interaction and media processing. The package includes security-conscious features, such as a warning in package.sh to prevent the accidental inclusion of .env files containing API credentials, and lacks any indicators of malicious intent, data exfiltration, or prompt injection.