Is bzsega/sergei-mikhailov-stt safe?
Yes. bzsega/sergei-mikhailov-stt is safe to install. Oathe's behavioral security audit gave the sergei-mikhailov-stt skill by bzsega a trust score of 94/100 with 3 findings, none critical or high.
https://github.com/openclaw/skills/tree/main/skills/bzsega/sergei-mikhailov-stt
Is bzsega/sergei-mikhailov-stt safe to install?
This is a legitimate speech-to-text skill that provides audio transcription services using Yandex SpeechKit API. The code appears well-structured with appropriate error handling and follows expected patterns for audio processing applications. No malicious behavior or security vulnerabilities were detected.
What security issues were found in bzsega/sergei-mikhailov-stt?
Category Scores
Findings (3)
LOW Canary file access during installation -10 ▶
System processes accessed honeypot files (.env, SSH keys, AWS credentials) during skill installation. However, all canary files remained intact and unmodified, indicating no actual data exfiltration occurred.
INFO Subprocess usage for audio processing -5 ▶
The skill uses Python subprocess calls to execute ffmpeg for audio format conversion, which is appropriate and expected for speech-to-text functionality.
INFO External API dependency -5 ▶
The skill depends on Yandex SpeechKit external API service for core functionality, which introduces dependency risk but is appropriate for the stated purpose.
Should I install bzsega/sergei-mikhailov-stt?
Oathe's verdict for bzsega/sergei-mikhailov-stt is SAFE with a trust score of 94/100. Recommendation: Install.