Provides Speech-to-Text (STT) and text Translation using the Addis Assistant API (api.addisassistant.com). Use when the user needs to convert an audio file to text (specifically Amharic), or translate text between languages (e.g., Amharic to English). Requires 'x-api-key'.

This skill appears to do what it claims (Amharic STT and translations) but there are a few things to check before installing or running it: - Verify the service/domain: api.addisassistant.com has no listed homepage in the package metadata. Confirm the API provider is legitimate and trustworthy before sending audio or text and before giving them an API key. - Provide the API key carefully: the scripts expect the x-api-key as a command-line argument, which can be visible in process lists on your system. Prefer passing secrets via a secure mechanism (stdin, environment variable, or a secrets manager) and avoid typing keys directly on shared machines. - Required binary not declared: the scripts call the curl binary but the skill metadata does not list curl as required. Ensure curl is installed, or review the scripts and consider using a vetted implementation (e.g., Python requests) that clearly documents dependencies. - Confirm TLS/URL: the examples use api.addisassistant.com without an explicit scheme; ensure the real requests use HTTPS (https://api.addisassistant.com) so data is encrypted in transit. - Audit the code before running: the included scripts are short and readable, but you should review them yourself to ensure they match the shipped content and that no modifications exfiltrate data elsewhere. Given the unknown origin and the metadata mismatches, do not hand over sensitive or high-privilege API keys until you verify the service and fix the dependency/credential handling. If you want, I can list concrete changes to make the skill safer (declare curl as required, accept API key via env or stdin, add HTTPS to endpoints, or replace curl with requests).

Type: OpenClaw Skill Name: addis-assistant-stt Version: 1.0.0 The skill is designed for Speech-to-Text and text translation using the Addis Assistant API. The `SKILL.md` provides clear instructions without any prompt injection attempts. The Python scripts (`stt.py`, `translate.py`) use `subprocess.run` to execute `curl` commands, sending an API key and user-provided data (audio file path or text) to `api.addisassistant.com`. This behavior is directly aligned with the stated purpose of interacting with an external API and does not show evidence of intentional malicious activity such as data exfiltration beyond the API interaction, persistence, or unauthorized command execution. The use of `curl` with arguments passed as a list mitigates common shell injection risks.