TencentCloud ASR

腾讯云语音识别 ASR Skill，适用于语音转文字、音频转写、字幕生成、会议转录、语音消息识别、 本地文件或 URL 音频识别。包含三种模式：一句话识别（<=60s 短音频）、录音识别极速版 （<=2h/100MB 中长音频快速同步返回）、录音识别（<=5h 长音频异步识别）。支持普通话、 英语、粤语、日语、韩...

Plain-language considerations before installing or using this skill: - The skill actually needs your Tencent Cloud credentials (TENCENTCLOUD_SECRET_ID and TENCENTCLOUD_SECRET_KEY, and sometimes TENCENTCLOUD_APPID) even though the registry metadata says none — do not paste secrets into group chat; prefer configuring them locally or providing them only in a secure, private channel. - At runtime the skill may auto-install software: it can call system package managers (apt/dnf/yum/zypper/brew/winget/choco, possibly with sudo) to install ffmpeg/ffprobe and will pip-install the tencentcloud SDK. That means it can modify the host system and requires network access. Only run it on machines where you accept those changes (e.g., disposable VM, container, or developer machine), or inspect and run the scripts manually yourself. - The code references and may read host file paths (e.g., QQ Bot downloads directory) for integrations — if you don't want that, don't enable the QQ Bot integration or run the skill in an isolated environment. - The SKILL.md includes helpful security guidance (prefer temporary env injection, don't write keys to shell profiles), but some reference docs also show how to persist keys. Decide your preferred credential handling policy and enforce it (temporary env vs. persistent profile). - If you are not comfortable with automated package installs, review the scripts (ensure_ffmpeg.py, file_recognize.py, etc.) and run them manually under supervision, or set up ffmpeg and the Python SDK yourself before invoking the skill. What would increase my confidence: updated registry metadata that correctly lists required environment variables/primary credential and an explicit install manifest or an option to disable autonomous installation. If those aren’t provided, treat this skill as requiring elevated trust and run it only in an isolated environment.

Type: OpenClaw Skill Name: tencentcloud-asr Version: 0.1.5 The skill bundle contains scripts designed for autonomous system-level configuration and dependency management, which are high-risk capabilities. Specifically, `ensure_ffmpeg.py` attempts to install FFmpeg using various system package managers (e.g., apt-get, yum, brew) and may use sudo or add external repositories like RPM Fusion. Additionally, several scripts including `file_recognize.py` and `flash_recognize.py` perform autonomous pip installations of dependencies. While these actions are aligned with the stated purpose of providing ASR functionality, the instructions in `SKILL.md` direct the AI agent to execute these high-privilege setup scripts autonomously, which could lead to unauthorized system modifications or be exploited if the agent's environment is not properly sandboxed.