功能描述

Transcribe audio files with speaker diarization (who speaks when). Supports 100+ languages, automatic language detection, and timestamps. Use for meetings, interviews, podcasts, or voice messages. Requires AssemblyAI API key.

使用说明 (SKILL.md)

AssemblyAI Transcriber 🎙️

Name: AssemblyAI Transcriber
Author: xenofex7

Transcribe audio files with speaker diarization (who speaks when).

Features

✅ Transcription in 100+ languages
✅ Speaker diarization (Speaker A, B, C...)
✅ Timestamps per utterance
✅ Automatic language detection
✅ Supports MP3, WAV, M4A, FLAC, OGG, WEBM

Setup

Create AssemblyAI account: https://www.assemblyai.com/
Get API key (free tier: 100 min/month)
Set environment variable:

export ASSEMBLYAI_API_KEY="your-api-key"

Or save to config file:

// ~/.assemblyai_config.json
{
  "api_key": "YOUR_API_KEY"
}

Usage

Transcribe local audio

python3 scripts/transcribe.py /path/to/recording.mp3

Transcribe from URL

python3 scripts/transcribe.py https://example.com/meeting.mp3

Options

python3 scripts/transcribe.py audio.mp3 --no-diarization  # Skip speaker labels
python3 scripts/transcribe.py audio.mp3 --json            # Raw JSON output

Output Format

## Transcript

*Language: EN*
*Duration: 05:32*

**Speaker A** [00:00]: Hello everyone, welcome to the meeting.
**Speaker B** [00:03]: Thanks! Happy to be here.
**Speaker A** [00:06]: Let's start with the first item...

Pricing

Free Tier: 100 minutes/month free
After: ~$0.01/minute

Tips

For best speaker diarization: clear speaker changes, minimal overlap
Background noise is filtered well
Multi-language auto-detection works reliably

Author: xenofex7 | Version: 1.1.0

安全使用建议

This skill appears to do exactly what it says: it uploads audio to AssemblyAI and returns a transcript with speaker labels. Before installing, note the following: (1) audio is sent to a third-party service (AssemblyAI) — do not use it for highly sensitive audio unless you accept that external processing will occur; (2) store your API key securely (environment variable or ~/.assemblyai_config.json). The script looks for a config file in home and cwd and also in an unusual high-level ancestor path which may resolve to the filesystem root — make sure you know which file the script will read so your key isn't accidentally read from an unexpected location; (3) README mentions Telegram support but the shipped code does not implement it (this is likely a documentation mismatch, not hidden functionality); (4) the script reads whole files into memory before upload — avoid very large files to prevent resource issues. If you need explicit assurances, ask the author for i) confirmation of the config-path behavior and ii) an explicit privacy/data-retention statement from their AssemblyAI account settings or usage policy.

功能分析

Type: OpenClaw Skill Name: assemblyai-transcriber Version: 1.1.0 The skill is classified as suspicious due to a critical input sanitization vulnerability in `scripts/transcribe.py`. The script directly uses `sys.argv[1]` as an `audio_source` without validation, allowing an attacker to potentially trick the OpenClaw agent (via prompt injection) into uploading arbitrary local files (e.g., `/etc/passwd`, `~/.ssh/id_rsa`) to the AssemblyAI service. While the data is sent to the legitimate AssemblyAI endpoint, this constitutes an unauthorized data disclosure vulnerability, not intentional malicious exfiltration by the skill itself.

能力评估

✓ Purpose & Capability

Name/description ask for AssemblyAI transcription with diarization and the code calls AssemblyAI's /upload and /transcript endpoints and requires ASSEMBLYAI_API_KEY — this is coherent. One minor mismatch: README mentions 'Telegram Support' but no Telegram code is present.

ℹ Instruction Scope

SKILL.md instructs use of an API key and running the provided script, which stays within the stated purpose. The script does check for a config file in multiple locations (home, cwd) which is expected, but also checks Path(__file__).parent.parent.parent.parent / '.assemblyai_config.json' (a high-level ancestor path that can resolve to the filesystem root on typical layouts) — odd but not clearly malicious. The script uploads audio (local or by URL) to AssemblyAI as expected; it does not attempt to read other unrelated files or system secrets.

✓ Install Mechanism

No install spec included (instruction-only with a small Python script). Nothing is downloaded or written to disk at install time by the skill bundle itself.

ℹ Credentials

Only ASSEMBLYAI_API_KEY is required, which is proportionate. The code also supports reading a config file from several locations (home, cwd, and an unusual high-level ancestor path); users should be aware where they place their API key so it isn't read from an unexpected location.

✓ Persistence & Privilege

Skill is not always-enabled and does not request elevated or persistent platform privileges. It does not modify other skills or system-wide settings.

版本历史

v1.1.0

English docs, added metadata with required env vars

v1.0.0

Initial release - Audio transcription with speaker diarization

元数据

Slug assemblyai-transcriber

版本 1.1.0

许可证 —

累计安装 0

当前安装数 0

历史版本数 2

常见问题