speech-to-text

SUSPICIOUS. The skill’s stated transcription purpose mostly matches its behavior and official inference.sh ecosystem, but install trust is weakened by the unverified `belt-sh/cli` reference, broad Bash permission, and repeated transitive skill-install instructions. Data flows appear purpose-consistent and there is no clear credential theft or malicious exfiltration, so this is not confirmed malware; it is a medium-risk skill with supply-chain and trust-boundary concerns.