← 返回 Skills 市场
119
总下载
0
收藏
0
当前安装
1
版本数
在 OpenClaw 中安装
/install jx-asr
功能描述
Transcribe audio from URLs or local files into text using multilingual automatic speech recognition via SkillBoss API Hub.
使用说明 (SKILL.md)
ASR (Automatic Speech Recognition) Skill
Fast, accurate automatic speech-to-text transcription powered by SkillBoss API Hub.
Why use this skill?
- Multilingual: Supports 100 languages with auto-detection.
- Flexible Input: Transcribe from a URL or a local file.
- Agent-Ready: Designed for high-volume, automated pipelines.
- Unified API: Powered by SkillBoss API Hub — single key, single endpoint.
Setup
1. Get an API Key
Sign up at skillbossai.com to obtain your SKILLBOSS_API_KEY.
2. Configure Authentication
This skill looks for your API key in the SKILLBOSS_API_KEY environment variable.
Add this to your .env or agent config:
SKILLBOSS_API_KEY=your_key_here
Usage
TL;DR for Agents
When this skill is installed, you can transcribe any URL or local file by running:
./skills/asr/scripts/asr.sh transcribe --url "https://example.com/audio.mp3"
Transcribe a URL
# Basic transcription
./skills/asr/scripts/asr.sh transcribe --url "https://example.com/audio.mp3"
# With language hint
./skills/asr/scripts/asr.sh transcribe --url "https://example.com/audio.mp3" --language "en"
Transcribe a Local File
# Upload and transcribe local media
./skills/asr/scripts/asr.sh transcribe --file "./local-audio.wav"
Supported Options
--language \x3Ccode>: ISO language code (e.g., 'en', 'es')
Output
Returns a JSON response. The transcription text is in:
.result.text
If the SKILLBOSS_API_KEY is missing, the tool will provide a clear error message.
安全使用建议
What to check before installing:
- Verify the provider domain and repository: SKILL.md mentions signing up at skillbossai.com but the script and manifest use heybossai.com / api.heybossai.com. Confirm which domain is legitimate and that your API key will be sent to the intended service.
- Confirm the manifest actually published with SKILLBOSS_API_KEY as a required env var; the top-level metadata you were shown omitted it. Treat that discrepancy as a packaging error until proven otherwise.
- Understand data flow: any URL you feed (or any local file you point at) will be downloaded/read and uploaded (base64 in JSON) to the external API. Do not send sensitive audio unless you trust the service and privacy terms.
- Ensure your environment has the expected CLI tools the script uses (curl, base64, mktemp). The skill did not declare required binaries even though the script uses them.
- Test with non-sensitive audio and a disposable API key first. If possible, use a least-privilege or time-limited key for initial testing.
- If you need higher assurance, inspect the repository at the manifest's 'repository' URL and contact the provider to confirm the correct signup domain and API endpoint.
Given the domain/metadata inconsistencies, proceed only after verifying the provider and the destination of your API key and audio data.
功能分析
Type: OpenClaw Skill
Name: jx-asr
Version: 1.0.0
The script `scripts/asr.sh` contains a command injection vulnerability because it uses an unquoted heredoc (`<<EOF`) to construct a JSON payload. This allows for shell expansion of the `$FILENAME` and `$LANGUAGE` variables, which are derived from user-controlled arguments (`--url`, `--file`, or `--language`). An attacker or a malicious prompt could trigger arbitrary code execution by providing a filename containing shell metacharacters (e.g., `$(whoami)`). While the skill's stated purpose of transcribing audio via `api.heybossai.com` appears legitimate, the implementation lacks proper input sanitization.
能力标签
能力评估
Purpose & Capability
The script, SKILL.md, and manifest consistently implement an ASR client that uploads audio to an external API (https://api.heybossai.com). However the top-level registry metadata provided to you omitted the required env var and declared 'no required env vars'. The README/manifest/README author text reference 'heybossai.com' while SKILL.md instructs signup at 'skillbossai.com' — a domain mismatch that is unexplained.
Instruction Scope
The runtime instructions and the included script are narrowly scoped: they download a URL or read a local file, base64-encode the audio, and POST it to the API endpoint with the SKILLBOSS_API_KEY. The instructions do not direct the agent to read other files, network endpoints, or additional environment variables beyond the API key. Note: the agent will download arbitrary URLs and transmit their contents to a third-party service.
Install Mechanism
There is no install spec and the skill ships as a small shell script plus docs. No external downloads or archive extraction occur at install time. This is a low-risk install mechanism, but the packaged script will be written to disk as part of installing the skill bundle.
Credentials
Operationally the skill requires a single API key (SKILLBOSS_API_KEY) which is proportionate to the stated purpose. However the registry-level metadata you were shown claims 'Required env vars: none' and 'Primary credential: none' while the manifest and SKILL.md do require SKILLBOSS_API_KEY — this inconsistency is concerning. Also the SKILL.md and script point to two different domains (skillbossai.com vs heybossai.com), increasing the risk of misconfiguration or credential leakage to the wrong service.
Persistence & Privilege
The skill is not marked always:true and does not request elevated or persistent system privileges. It does not modify other skills or system-wide settings. Autonomous invocation is allowed (platform default) but not in itself a red flag here.
如何使用
- 确保已安装 OpenClaw（本地或 Docker 部署）
- 在对话框中输入安装命令：
/install jx-asr - 安装完成后，直接呼叫该 Skill 的名称或使用
/jx-asr触发 - 根据 Skill 的参数说明提供必要输入，即可获得结构化输出
版本历史
v1.0.0
- Initial release of the ASR (Automatic Speech Recognition) skill.
- Supports fast, accurate speech-to-text transcription for 100 languages with auto-detection.
- Accepts both URL and local file inputs for transcription.
- Easy setup using a single SkillBoss API Key as an environment variable.
- Includes ready-to-use shell scripts for quick transcribing and multiple usage examples.
- Returns transcript as JSON, with clear error messages if API key is missing.
元数据
常见问题
asr 是什么？
Transcribe audio from URLs or local files into text using multilingual automatic speech recognition via SkillBoss API Hub. 它是一个面向 Claude Code / OpenClaw 的 AI Agent Skill 插件，目前累计下载 119 次。
如何安装 asr？
在 OpenClaw 或 Claude Code 对话框中运行命令「/install jx-asr」即可一键安装，无需额外配置。
asr 是免费的吗？
是的，asr 完全免费，采用 MIT-0 许可证，可自由下载、安装和使用。
asr 支持哪些平台？
asr 跨平台运行，可在任意部署了 OpenClaw / Claude Code 的环境中使用（cross-platform）。
谁开发了 asr？
由 KirkRaman（@kirkraman）开发并维护，当前版本 v1.0.0。
推荐 Skills