add-voice-transcription
Pass
Audited by Gen Agent Trust Hub on Mar 12, 2026
Risk Level: SAFE
Full Analysis
- [EXTERNAL_DOWNLOADS]: Fetches source code and updates from the vendor's official repository at
github.com/qwibitai/nanoclaw-whatsapp.gitto implement the transcription module. - [COMMAND_EXECUTION]: Utilizes standard build and test tools (
npm,npx vitest) to integrate the new functionality and verify the WhatsApp channel handler. - [CREDENTIALS_UNSAFE]: Guides the user to configure an OpenAI API key within a local
.envfile for authenticating with the transcription service. - [DATA_EXFILTRATION]: Transmits audio data to OpenAI's Whisper API; this is the primary intended behavior of the skill for converting voice messages to text.
- [PROMPT_INJECTION]: The skill processes untrusted audio content from WhatsApp users, which could contain malicious instructions.
- Ingestion points:
src/channels/whatsapp.tsvia thetranscribeAudioMessagecall. - Boundary markers: Transcription results are wrapped in
[Voice: <transcript>]delimiters to distinguish them from direct text messages. - Capability inventory: The skill enables the agent to read and respond to voice message content.
- Sanitization: No specific text sanitization is applied to the transcript before it is delivered to the agent context.
Audit Metadata