whatsapp-voice-transcriber

Pass

Audited by Gen Agent Trust Hub on Jun 24, 2026

Risk Level: SAFE
Full Analysis
  • [COMMAND_EXECUTION]: The script executes transcription and notification tools using list-based arguments with subprocess.run. This method effectively prevents shell injection attacks by ensuring that user-provided file paths are treated as literal strings rather than executable commands.\n- [EXTERNAL_DOWNLOADS]: The skill utilizes well-known machine learning libraries such as mlx-whisper and openai-whisper. It correctly identifies that models will be fetched from reputable sources like Hugging Face during the first execution.\n- [DATA_EXFILTRATION]: Transcribed content is only sent to external targets if the user explicitly configures the NOTIFY_TARGET environment variable. This notification feature via the OpenClaw tool is an intended part of the skill's workflow and remains under the user's control.
Audit Metadata
Risk Level
SAFE
Analyzed
Jun 24, 2026, 01:09 AM