📦 audio-transcribe — 技能工具

v1.0.0

Transcribe, diarise, translate, post-process, and structure audio/video with AssemblyAI. Use this skill when the user wants AssemblyAI specifically, needs hi...

0· 24·0 当前·0 累计

by @tobeyrebecca (TobeyRebecca)·MIT-0

开发工具代码生成 API工具视频处理 MCP工具

下载技能包

License

MIT-0

最后更新

2026/4/14

安全扫描

VirusTotal

可疑

查看报告

OpenClaw

可疑

high confidence

The skill claims to call AssemblyAI but its code and required credential point to a different service (SKILLBOSS / heybossai), which is a significant mismatch and could send your audio/transcripts to an unexpected third party.

评估建议

Do not install or provide credentials until this mismatch is resolved. The skill advertises AssemblyAI but its script points to https://api.heybossai.com and requires SKILLBOSS_API_KEY — meaning your audio and transcripts would be sent to that third-party service, not directly to AssemblyAI. Ask the author to: (1) explain why SKILLBOSS/HeyBoss endpoints are used (is it a proxy/service aggregator?), (2) provide a clear privacy/data-flow statement, and (3) offer an option to use native AssemblyAI ...

详细分析 ▾

⚠ 用途与能力

Name/description and many assets claim AssemblyAI integration and show AssemblyAI endpoints and env names (ASSEMBLYAI_API_KEY), but the runnable code sets the API base to https://api.heybossai.com/v1 and the declared required environment variable is SKILLBOSS_API_KEY. Requiring SKILLBOSS_API_KEY is not coherent with a skill advertised as 'AssemblyAI' and suggests requests will go to a different service.

⚠ 指令范围

SKILL.md instructs agents to call AssemblyAI/LLM Gateway endpoints and references ASSEMBLYAI-related environment variables, but the implementation uses the SKILLBOSS API base and SKILLBOSS_API_KEY. The CLI uploads local files and will send audio/transcript data to the base URL configured in the script — currently pointing to a third-party domain rather than assemblyai.com. The skill also exposes raw request passthroughs (e.g., --request/--understanding-request) which is expected for flexibility but increases the risk that arbitrary content could be sent to the configured endpoint.

✓ 安装机制

No install spec; it is an instruction-only Node.js CLI and only requires the 'node' binary. That is proportionate for a Node-based CLI skill.

⚠ 凭证需求

The skill requires a single env var named SKILLBOSS_API_KEY (declared as primary). For an AssemblyAI integration one would expect ASSEMBLYAI_API_KEY (or similar) and official AssemblyAI endpoints. Requesting SKILLBOSS_API_KEY is disproportionate given the stated purpose and points to use of a different service for handling audio and transcripts.

✓ 持久化与权限

The skill does not request always:true and does not appear to modify other skills' configs. It can be invoked autonomously (default), which is normal; this raises the blast radius only in combination with the other concerns above.

⚠ scripts/assemblyai.mjs:28

Environment variable access combined with network send.

⚠ scripts/assemblyai.mjs:625

File read combined with network send (possible exfiltration).

安全有层次，运行前请审查代码。

License

MIT-0

可自由使用、修改和再分发，无需署名。

查看条款 ↗

运行时依赖

无特殊依赖

版本

latestv1.0.02026/4/14

AssemblyAI-specific, agent-friendly audio/video transcription and processing. - Now focused on AssemblyAI features: model routing, diarisation, speaker mapping, and advanced transcript exports (Markdown, JSON, manifest). - Provides a CLI for transcription, understanding, formatting, LLM-based extraction, and bundled output for agents or downstream workflows. - Supports language detection/code-switching, translation, and rich output formats (subtitles, paragraphs, sentences). - Facilitates advanced workflows: speaker name/role mapping, structured extraction, agent-ready outputs. - Includes model/language lookup commands and local bundled knowledge for easy discovery of supported features.

● 可疑

安装命令

点击复制

官方npx clawhub@latest install toby-audio-transcribe

镜像加速npx clawhub@latest install toby-audio-transcribe --registry https://cn.longxiaskill.com

数据来源：ClawHub ↗ · 中文优化：龙虾技能库