The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses subprocess.run to call system tools like ffmpeg, ffprobe, and sysctl. These are necessary for processing media files and determining hardware capabilities. It also uses subprocess to manage a Python virtual environment and run the transcription models. All command calls use list-style arguments and static or validated paths to prevent shell injection vulnerabilities.
[EXTERNAL_DOWNLOADS]: During the setup process, the skill downloads Python packages via uv and model weights from Hugging Face using the huggingface_hub library. These dependencies and model snapshots are pinned by specific versions and commit hashes in runtime/requirements.lock and runtime/models.lock.json. These operations target well-known registries and repositories.
[DATA_EXFILTRATION]: The skill supports online transcription via ByteDance's Doubao API. This involves uploading audio data to official ByteDance servers. The skill includes strict safeguards, requiring the user to provide explicit consent via the --online-consent flag and includes prompt instructions to avoid this path unless the user specifically requests cloud-based transcription. As this is a documented feature requiring explicit opt-in, it does not constitute unauthorized exfiltration.
[CREDENTIALS_UNSAFE]: The skill uses environment variables (DOUBAO_API_KEY, etc.) for API authentication. It contains explicit instructions for the AI agent to never log, print, or persist these values, following standard security practices for secret management.

audio-transcription