Agent skill · Audited from source
asr-transcribe-to-text
skill · daymade/claude-code-skillsMIT licenceAudited 20 Oct 2026 · source 9cc14bf9d5fa
Is it safe? With care — CAUTION, grade B (89/100). We read this skill's source at commit 9cc14bf9d5fa and observed network access and no hard-coded secrets. The audit raised 5 findings, 0 critical or high. What it does: Transcribes audio or video to speaker-labeled, timestamped text, locally with MLX on Apple Silicon or remotely. Use for 转录 / 录音转文字 / 说话人分离 / 字幕, and also for preparing audio for ASR without transcribing: 转格式, 降采样到…
Cite
Cite this page
ModelsAtlas. “asr-transcribe-to-text (daymade/claude-code-skills)”. Retrieved 20 Oct 2026. https://modelsatlas.com/skills/daymade/asr-transcribe-to-text
Trust audit
Audit 0.4.1 · source read 20 Oct 2026
CAUTION means the audit found things worth knowing before you trust this skill. Grade B is shared by 13,985 of 14,816 audited skills.
What the source does
- FilesystemNone observedNo reads or writes in the source
- NetworkDeclared6 observations
- ShellNone observedNo commands run in the source
- DependenciesPinnedNothing floats
- SecretsNone foundNo keys in source
Five audit layers
| Layer | What we check | Result | Findings |
|---|---|---|---|
L0 Provenance | Repo owner, licence, archive status, activity | PASS | 1 |
L1 Static source | Secrets, path traversal, supply chain, hidden code | PASS | 2 |
L2 Instructions | Prompt injection, authority framing, hidden directives | WARN | 2 |
L3 Inventory | The files and declarations match the source | PASS | 0 |
L4 Sandbox | Run in isolation and watch behaviour | SKIPPED why | 0 |
Gates applied: no behavioural pass.
Findings (5)
MEDIUMPrompt injectionreview.data_transfer · SKILL.md
it fetches a public URL — base64 is rejected — so it needs staging (see `aliyun-multi-account.md`)
- Why
- Instructs the agent to stage the user's audio on public infrastructure so a third-party vendor can download it.
- Fix
- rewrite it so the instruction says plainly what it does, and asks the user before it acts
MEDIUMPrompt injectionreview.misleading_scope · SKILL.md
it fetches a public URL — base64 is rejected — so it needs staging (see `aliyun-multi-account.md`)
- Why
- The package description only mentions remote ASR execution; public-URL staging plus a referenced multi-account setup is a significant scope extension not advertised.
- Fix
- rewrite it so the instruction says plainly what it does, and asks the user before it acts
LOWInventory / provenanceinv.symlink · AGENTS.md
AGENTS.md
- Why
- link not followed
- Fix
- —
LOWCode injectioncode.eval_exec · tests/test_execution_evidence.py:112
exec(compile(ast.Module(body=[node], type_ignores=[]), "gpu_guard", "exec"), namespace)
- Why
- evaluates text as code
- Fix
- remove; use a parser or a dispatch table
LOWNetwork egressnet.raw_ip · tests/test_execution_evidence.py:61
base = f"http://127.0.0.1:{server.server_port}"- Why
- No further detail recorded for this rule.
- Fix
- —
Audit 0.4.1 · source sha 9cc14bf9d5fa · 20 Oct 2026Report an issue or request a re-scan
Provenance
Who published it, and what the verdict is pinned to
- Publisherdaymade GitHub userOwner of the repository this skill is read from
- Source folderdaymade/claude-code-skills/daymade-audio/asr-transcribe-to-textThe exact folder we audited
- LicenceMITAs the repository states it
- Commit pinned for this verdict9cc14bf9d5faA new audit runs when the source changes
- Repository statusNot archivedPushed today
- Sandboxed runNot runSkills are read, not executed; layer L4 is skipped
What it tells the agent
Full source on GitHub ↗Its description: Transcribes audio or video to speaker-labeled, timestamped text, locally with MLX on Apple Silicon or remotely. Use for 转录 / 录音转文字 / 说话人分离 / 字幕, and also for preparing audio for ASR without transcribing: 转格式, 降采样到…
---
name: asr-transcribe-to-text
description: >-
Transcribes audio or video to speaker-labeled, timestamped text, locally with MLX on Apple Silicon
or remotely. Use for 转录 / 录音转文字 / 说话人分离 / 字幕, and also for preparing audio for ASR without
transcribing: 转格式, 降采样到 16kHz, merging recorder segments, or compressing and speeding up audio
before 飞书妙记 — even when it looks like a one-line ffmpeg job.
argument-hint: "[audio-or-video-file-path-or-url ...]"
---
# ASR Transcribe to Text
Transcribe audio/video to **speaker-labeled** text. Local execution has two
explicit routes. Long or unattended recordings use checkpointed whisper.cpp +
Silero VAD blocks, then late-fuse pyannote speakers. Short/medium recordings may
use the Qwen3-ASR + mlx-whisper alignment route. Neither route cuts ASR input at
diarization turns; speaker attribution happens after continuous-context ASR.
## Route before ASR: the transcript is the result, not the run
Before starting transcription, check the owning project's transcript catalog,
external source index, and declared prior-work carriers for an existing
canonical transcript using source ID, date, title, and entity terms. A verified
human-reviewed/current transcript ends the task unless the user explicitly
asked for a new independent comparison. Raw audio existing is not a reason to
regenerate text that already exists.
When no canonical transcript exists:
1. For ordinary meeting/DJI recordings where cloud processing is allowed, use
Feishu Minutes as the normal primary route (preprocess to a small M4A first).
2. Use local ASR when the user requires offline/privacy handling, Feishu is
unavailable or failed, or the task explicitly needs an independent quality
comparison.
2b. **For a second, independent speaker timeline**, use StepFun's async file
endpoint via the `stepfun-asr` skill's `asr_file.py`. It is the only vendor
diarization route here that does not share code or models with local pyannote, so
agreement between the two is real corroboration rather than one tool agreeing
with itself. Measured 2026-09-19 on a 10-minute film: both split the key turn
identically, while Feishu Minutes mis-attributed it. The constraint is that it
fetches a public URL — base64 is rejected — so it needs staging (see
`aliyun-multi-account.md`); reach for it when an attribution is load-bearing,
not for routine transcripts.
3. For non-meeting media or an explicit local/remote ASR request, choose the
execution location by the audio-location rule below.
Do not run local ASR merely to make a two-route process look complete.
Before choosing local versus remote execution, read
[execution location and comparison](references/execution_location_and_comparison.md).
Use existing text and validated checkpoints first, then compare source placement,
processing permission, actual GPU/model identity and end-to-end quality evidence.
When measurements are missing, prefer an eligible route next to the audio and
state that this avoids a transfer; do not claim it is faster.
Configuration persists in `${CLAUDE_PLUGIN_DATA}/config.json`.
> **Speaker labels are the default.** Every run produces `[start-end] SPEAKER_xx: text`
> + CSV. Plain-text-only output is the opt-out (`--no-diarization`) for monologues,
> podcasts, or when you just want a summary — see Step 3. It also drops every
> timestamp: the plain-text path returns the session text and nothing else. A
> monologue that needs line-level timestamps (subtitles, jump-to-moment archives)
> runs the full pipeline and ignores the `SPEAKER_00` labels.
>
> **One-time setup for diarization:** pyannote is a gated HuggingFace model — it
> needs a token once (`## Speaker Diarization & Identification` below). First run
> without it FAILS with setup steps; after setup, full capability is permanent
> and auto-detected.
## Step 0: Detect Platform and Load Config
```bash
cat "${CLAUDE_PLUGIN_DATA}/config.json" 2>/dev/null
```
**If config exists**, read values and proceed to Step 1.
**If config does not exist**, auto-detect platform first:
```bash
python3 -c "
import sys, platform
is_mac_arm = sys.platform == 'darwin' and platform.machine() in ('arm64', 'aarch64')
print(f'Platform: {sys.platform} {platform.machine()}')
print(f'Apple Silicon: {is_mac_arm}')
if is_mac_arm:
print('RECOMMEND: local-mlx')
else:
print('RECOMMEND: remote-api')
"
```
Then use **AskUserQuestion** with platform-aware defaults:
For **macOS Apple Silicon** (recommended: local):
```
ASR setup — your Mac supports local MLX; choose from data location and the execution SOP.
Q1: Transcription mode?
A) Local MLX — runs on your Mac's GPU, no API key needed
B) Remote API — send audio to a server (vLLM, Tailscale workstation, etc.)
Q2: Does your network have an HTTP proxy that might intercept traffic?
A) Yes — bypass proxy for ASR traffic (Recommended if using Shadowrocket/Clash)
B) No — direct connection
```
For **other platforms** (recommended: remote):
```
ASR setup — local MLX requires macOS Apple Silicon. Using remote API mode.
Q1: ASR Endpoint URL?
A) https://asr.example.com/v1/audio/transcriptions (Self-hosted remote ASR)
B) http://localhost:8002/v1/audio/transcriptions (Local ASR server)
C) Custom URL
Q2: Proxy bypass needed?
A) Yes (Recommended for Shadowrocket/Clash/corporate proxy)
B) No
```
Save config:
```bash
mkdir -p "${CLAUDE_PLUGIN_DATA}"
python3 -c "
import json
config = {
'mode': 'MODE', # 'local-mlx' or 'remote-api'
'model': 'MODEL_ID', # local: 'mlx-community/Qwen3-ASR-1.7B-8bit', remote: 'Qwen/Qwen3-ASR-1.7B'
'max_tokens': 8192, # local only; PER 20-minute chunk, not per recording
'endpoint': 'URL', # remote only
'noproxy': True,
'max_timeout': 900 # remote only
# 'diarization_declined': True # set only after the user explicitly declines
# the pyannote setup in Step 3 — every run then warns + goes plain-text
# until an HF token aExcerpt, first 6,000 characters of SKILL.md, verbatim from the audited commit. It is text from someone else’s repository, quoted so you can judge it before your agent reads it.
Install
Pinned to the audited commit 9cc14bf
uv run ${CLAUDE_SKILL_DIR}/scripts/resolve_media_input.py \
uv run ${CLAUDE_SKILL_DIR}/scripts/prepare_asr_input.py SEG1.wav SEG2.wav -o merged.wav # merge only
uv run ${CLAUDE_SKILL_DIR}/scripts/prepare_asr_input.py SEG*.wav -o upload.m4a --speed 1.3 # merge + quota-saving speedup
uv run ${CLAUDE_SKILL_DIR}/scripts/transcribe_long_whispercpp.py \
uv run --frozen ${CLAUDE_SKILL_DIR}/scripts/diarize_speakers.py \git clone https://github.com/daymade/claude-code-skills git -C claude-code-skills checkout 9cc14bf9d5fa
Commands as the repository documents them: shown, never run by us. Our verdict covers commit 9cc14bf9d5fa only.
Works in which agents?
What its own text says, not a test
| Agent | Status | More |
|---|---|---|
| Claude Code | Mentioned in its text, not tested | Skills for Claude Code · About Claude Code |
| Codex | Mentioned in its text, not tested | Skills for Codex · About Codex |
Audit history
Every audit, every source change
- !CAUTION B 89 / 100
first audit · source
9cc14bf9d5fa
README badge
For maintainers · shows the latest audit
[](https://modelsatlas.com/skills/daymade/asr-transcribe-to-text/)
The badge shows our verdict and grade for this skill, and links back to this page. It changes when the audit does.
Similar skills
obra/superpowers
Use when about to claim work is complete, fixed, or passing, before committing or creating PRs - requires running verification commands and confirming output before making any success claims; evidence before assertions…
obra/superpowers
Use when you have a spec or requirements for a multi-step task, before touching code
obra/superpowers
Use when starting any conversation - establishes how to find and use skills, requiring skill invocation before ANY response including clarifying questions
Add this badge to your README
[](https://modelsatlas.com/skills/daymade/asr-transcribe-to-text/)
<a href="https://modelsatlas.com/skills/daymade/asr-transcribe-to-text/"><img src="https://modelsatlas.com/skills/daymade/asr-transcribe-to-text/badge.svg" alt="ModelsAtlas: CAUTION B"></a>
Questions about asr-transcribe-to-text
What does the asr-transcribe-to-text skill do?
Is asr-transcribe-to-text safe to install?
What can asr-transcribe-to-text access on my machine?
Which assistants does asr-transcribe-to-text work with?
How current is this page?
Sources
- github.com/daymade/claude-code-skills/tree/main/daymade-audio/as — the audited source at commit 9cc14bf9d5fa and every finding aboveObserved · 20 Oct 2026
Spotted something wrong? Report a correction · Methodology
Keep going in your AI
Opens with this page as the source. We add nothing else to the prompt.
- What does the asr-transcribe-to-text skill do?
- Is asr-transcribe-to-text safe to install?
- What can asr-transcribe-to-text access on my machine?