← 返回 Skills 市场

Aliyun Speech Transcriber

Name: Aliyun Speech Transcriber
Author: chenggongdu

作者 chenggongdu · GitHub ↗ · v0.1.0 · MIT-0

cross-platform ⚠ suspicious

159

总下载

当前安装

版本数

在 OpenClaw 中安装

/install aliyun-speech-transcriber

功能描述

Transcribe publicly accessible audio or video URLs with Aliyun speech services. Use when the user wants speech-to-text via Aliyun DashScope, needs transcript...

使用说明 (SKILL.md)

Aliyun Speech Transcriber

Use this skill to turn externally accessible media URLs into transcript results.

Current scope

Current implementation focuses on DashScope file transcription using the paraformer-v2 model, aligned with the existing Java service pattern.

Required environment variables

ASR_DASHSCOPE_API_KEY

Fallback supported:

DASHSCOPE_API_KEY

Optional:

ALIYUN_SPEECH_MODEL - defaults to paraformer-v2
ALIYUN_SPEECH_LANG_HINTS - defaults to zh,en
ALIYUN_SPEECH_POLL_SECONDS - defaults to 5
ALIYUN_SPEECH_TIMEOUT_SECONDS - defaults to 1800

Inputs

Pass one or more externally accessible URLs:

node scripts/transcribe.js --file-url "https://example.com/audio.mp3"

Multiple files:

node scripts/transcribe.js --file-url "https://a.com/1.mp3" --file-url "https://a.com/2.mp3"

Output

The script returns JSON with:

success
provider
engine
taskId
requestId
results
text

text is a best-effort plain-text extraction from the final JSON result.

Chaining from Qiniu

Typical workflow:

Use qiniu-upload to upload a local file.
Prefer a signed private URL if the domain is not anonymously readable.
Pass the returned URL into this skill.

Safety rules

Never hardcode Aliyun credentials.
Fail fast if DASHSCOPE_API_KEY is missing.
Only send URLs the user intends to transcribe.

安全使用建议

This skill appears to do what it says: submit public media URLs to Aliyun DashScope and return transcripts. Before installing: ensure Node.js is available on the environment (the package instructs running node but 'required binaries' was left empty in metadata); keep your ASR_DASHSCOPE_API_KEY secret (do not hardcode it); only transcribe URLs you control or explicitly trust. Be aware the script will fetch any transcription_url the provider returns and include that content in its output — if an unexpected or malicious URL is returned it could cause the agent to retrieve and expose unintended data. If you need stronger guarantees, ask the author for URL validation (restrict to known storage hosts) or to avoid automatically fetching provider-supplied result URLs.

功能分析

Type: OpenClaw Skill Name: aliyun-speech-transcriber Version: 0.1.0 The skill is a legitimate implementation for transcribing audio/video URLs using the Aliyun DashScope API. The script `scripts/transcribe.js` correctly handles API authentication via environment variables, communicates only with official Aliyun endpoints (dashscope.aliyuncs.com), and contains no evidence of data exfiltration, malicious execution, or prompt injection.

能力评估

ℹ Purpose & Capability

The skill's name, description, SKILL.md, and included script all align: they submit public media URLs to Aliyun DashScope and return transcript JSON/plain text. The declared required environment variable (ASR_DASHSCOPE_API_KEY with a DASHSCOPE_API_KEY fallback) matches the code. One incongruity: registry metadata lists no required binaries, but the runtime instructions and included file require running 'node scripts/transcribe.js' (i.e., Node.js must be available).

⚠ Instruction Scope

The SKILL.md directs the agent to run the bundled Node script which only interacts with DashScope endpoints and the transcription result URLs. However, the script will fetch any transcription_url returned by DashScope and include that content in the printed JSON. If DashScope (or a malicious intermediary) returned a URL pointing at an internal endpoint or other unintended resource, the script would fetch and expose that content in the transcript output. The SKILL.md does include a safety rule to only send URLs the user intends to transcribe, but there is an inherent risk in following provider-supplied result URLs without additional validation.

✓ Install Mechanism

No install spec (instruction-only with an included script). All code is provided in the package, so nothing is downloaded from unknown external URLs at install time. This is low installation risk.

✓ Credentials

Only Aliyun DashScope API key environment variables are required (ASR_DASHSCOPE_API_KEY or DASHSCOPE_API_KEY); optional vars control model, language hints, and polling/timeouts. There are no unrelated credentials or broad access requests.

✓ Persistence & Privilege

The skill does not request permanent presence (always:false) and uses normal agent invocation. It does not modify other skills or system configs. This is proportionate for the stated function.

如何使用

确保已安装 OpenClaw（本地或 Docker 部署）
在对话框中输入安装命令：/install aliyun-speech-transcriber
安装完成后，直接呼叫该 Skill 的名称或使用 /aliyun-speech-transcriber 触发
根据 Skill 的参数说明提供必要输入，即可获得结构化输出

版本历史

v0.1.0

Initial release of Aliyun Speech Transcriber skill. - Enables transcription of publicly accessible audio/video URLs via Aliyun DashScope. - Supports JSON and plain-text transcript extraction from media URLs. - Accepts multiple URLs and integrates with Qiniu-uploaded media. - Requires `ASR_DASHSCOPE_API_KEY` environment variable for authentication. - Provides configurable model, language hints, polling interval, and timeout options. - Returns structured JSON including transcript text and metadata.

元数据

Slug aliyun-speech-transcriber

版本 0.1.0

许可证 MIT-0

累计安装 0

当前安装数 0

历史版本数 1

常见问题