Transcribe audio via Deepgram Nova-3 API (5.26% WER, 40x faster than Whisper, built-in speaker diarization). Use when user asks to transcribe audio, podcasts...

This skill is coherent with its stated purpose, but check these before installing: - It will send audio files to Deepgram (api.deepgram.com). Only use it for audio you are comfortable transmitting to that provider (PII/sensitive content consideration). - Provide a Deepgram API key either as environment variable DEEPGRAM_API_KEY or by storing it at ~/.openclaw/secrets/deepgram-api-key.txt. Prefer secure file permissions (chmod 600) if you use the secrets file. - The package metadata did not list required binaries; the script requires bash (already used), curl, and python3 to run. Ensure those are available and up-to-date. - The script parses remote responses with embedded Python; while it appears to only parse JSON, avoid running it on untrusted systems or modifying it without understanding the parsing behavior. - If you need offline/local transcription only, consider alternatives; otherwise the behavior and credentials requested are proportionate for a Deepgram integration.

Type: OpenClaw Skill Name: deepgram-transcribe Version: 1.0.0 The skill bundle is designed for Deepgram audio transcription, and its `SKILL.md` instructions are benign. However, the `scripts/transcribe.sh` script contains a potential shell injection vulnerability. The `$RESPONSE` variable, which holds the Deepgram API's JSON output, is directly embedded into a Python command's string literal (`python3 -c "... d = json.loads('''$RESPONSE''') ..."`). If an attacker could manipulate the Deepgram API response (e.g., via a compromised API or MITM), they could inject arbitrary Python code, leading to remote code execution. This is a vulnerability, not clear malicious intent, hence 'suspicious'.