📦 Audio
v1.0.0Handle audio messages as commands. When user sends an audio file (WAV/PCM/MP3), transcribe it using iFlytek Speed Transcription and either (1) execute the tr...
0· 2·0 当前·0 累计
by 下载技能包
最后更新
2026/4/26
安全扫描
OpenClaw
可疑
high confidenceThe skill claims to ‘execute’ transcribed audio as commands but the included code only transcribes, formats, and uploads results — the documentation and runtime behavior are inconsistent and it relies on external transcription/uploader skills (possible data exfiltration) without declaring that risk.
评估建议
Key things to consider before installing:
- Mismatch between docs and code: the README/skill description says it will "execute" transcribed audio as commands, but scripts/handle_audio.py only transcribes and prints/saves the result — it does not execute arbitrary shell commands. If you expected automated execution, do not assume it exists; conversely, if you worry about remote execution, the code is safer than the docs claim, but the docs could cause an agent to behave dangerously when chained w...详细分析 ▾
⚠ 用途与能力
The description and SKILL.md say audio can be transcribed and executed as commands. The shipped script transcribes audio, prepares output, and may save/upload results, but it does NOT actually execute arbitrary commands derived from the transcription. That is a substantive mismatch: the skill advertises command execution capability that the code does not implement.
⚠ 指令范围
SKILL.md instructs agents to run the ifly-speed-transcription and uploader scripts from specific workspace paths and describes executing transcriptions as commands. Those instructions grant broad discretion (execute user-provided text as commands) which is dangerous in general. The actual script does not perform shell execution, but the instructions still direct the agent to use other local scripts and to upload potentially sensitive content; this scope is broader than just transcription.
✓ 安装机制
No install spec or remote downloads: the skill is instruction-only with a local Python script. Nothing is pulled from external URLs during install, so install-time risk is low.
ℹ 凭证需求
The skill declares no credentials or env vars. It does, however, depend on external skills (ifly-speed-transcription and uploader) located under ~/.openclaw/workspace. Those helper scripts (not included here) may require credentials or upload targets; this skill will forward transcript data to them, so secret handling/exfiltration risk depends on those other skills.
✓ 持久化与权限
No elevated privileges requested: always is false, the skill does not modify other skill configs, and only writes files under the user's workspace directory. It uses subprocess to run other local scripts but does not install persistent agents or alter system-wide settings.
安全有层次，运行前请审查代码。
运行时依赖
无特殊依赖
版本
latestv1.0.02026/4/26
- Initial release of the Audio Command Handler skill. - Supports audio message transcription via iFlytek Speed Transcription (WAV/PCM/MP3 files). - Executes transcribed audio as commands if no accompanying text is provided. - If both audio and text command are present, uses transcription as context for the command. - Automatically saves and uploads results longer than 58 characters when processing audio + text command scenarios. - Supports Chinese, English, and 202+ Chinese dialects; audio up to 5 hours.
● 可疑
安装命令
点击复制官方npx clawhub@latest install audio-command-handler
镜像加速npx clawhub@latest install audio-command-handler --registry https://cn.longxiaskill.com