assemblyai-ci-integration View full skill →

Build AssemblyAI CI with offline REST, Streaming v3, webhook, gateway, secret, and lifecycle tests plus a tightly gated live lane.

ReadGlobGrepWriteEdit

AssemblyAI Contract-safe CI

Overview

Build AssemblyAI CI with offline REST, Streaming v3, webhook, gateway, secret, and lifecycle tests plus a tightly gated live lane. Treat live audio, transcript content, credentials, spend, and destructive state as separately governed boundaries.

Prerequisites

The target repository or integration path and the requested operator outcome.
The AssemblyAI project, environment, region, data classification, and accountable owner.
Current first-party documentation plus credentials only for a narrowly approved live check.

Current Contract

CI covers required model selection, job states, v3 turns and termination, both webhook schemas, gateway output contracts, retry bounds, and redaction. Live checks require protected secrets, synthetic audio, explicit regional routing, and hard request and spend budgets.

Authentication

For live work, inject ASSEMBLYAI_API_KEY from an approved secret manager and send the raw value only in the AssemblyAI Authorization header to the configured first-party host. Never print, commit, place in a URL, or expose it to an untrusted client. Callback secrets and temporary streaming tokens are separate credentials.

Instructions

Build synthetic audio and response fixtures for used surfaces.
Reject legacy v2 and LeMUR identifiers and missing model lists.
Test job success, terminal error, timeout, throttling, and duplicate reconciliation.
Test v3 begin, turns, malformed messages, disconnect, and termination.
Test callback auth, quick acknowledgment, duplicate delivery, and delayed work.
Scan artifacts for keys, URLs, audio, text, prompts, and tokens.

Tool Discipline

Use Read, Glob, and Grep to inspect repository code, configuration, fixtures, and evidence. Use Write and Edit only for approved implementation or documentation changes. Do not call AssemblyAI, upload audio, open a streaming session, mint a token, replay a callback, deploy, rotate a key, or delete a transcript merely because this skill was invoked.

Approval Boundaries

Require an accountable owner before live audio processing, production credential or endpoint changes, paid model or capacity changes, content retention, callback replay, deployment, or deletion. Read-only repository inspection and synthetic offline validation do not authorize live vendor actions.

Failure Modes

Mocked happy paths alone miss lifecycle boundaries.
Live tests on every pull request create uncontrolled cost.
Full transcript snapshots leak content into CI artifacts.

Output

Return the operation scope, environment, region, contract surface, authorization class, model and feature decisions, deterministic validation results, content-free identifiers, risks, cleanup or rollbac…

assemblyai-common-errors View full skill →

Analyze and triage AssemblyAI REST, transcript, Streaming v3, webhook, and LLM Gateway failures without leaking customer content.

ReadGlobGrepWriteEdit

AssemblyAI Failure Triage

Overview

Analyze and triage failures by contract layer without exposing customer speech. Treat live data, credentials, spend, and destructive state as separately governed boundaries.

Prerequisites

The target repository or integration path and the requested operator outcome.
The AssemblyAI project, environment, region, data classification, and accountable owner.
Current first-party documentation plus credentials only for a narrowly approved live check.

Current Contract

Transport status, transcript terminal status, WebSocket messages or close codes, webhook response behavior, and gateway results are separate failure layers. A 429 can represent shared account request or concurrency pressure; more keys do not multiply account capacity.

Authentication

For live work, inject ASSEMBLYAI_API_KEY from an approved secret manager and send the raw value only in the AssemblyAI Authorization header to the configured first-party host. Never print, commit, place in a URL, or expose it to an untrusted client. Callback secrets and temporary streaming tokens are separate credentials.

Instructions

Capture environment, region, operation, safe ID, timestamp, and last state.
Separate network, auth, validation, quota, processing, streaming, callback, and gateway failures.
Reproduce with synthetic input whenever possible.
Compare model and parameters to current mode-specific docs.
Collect only safe status, code, timing, and request metadata.
Classify retry, input correction, capacity action, or escalation.

Tool Discipline

Use Read, Glob, and Grep to inspect repository code, configuration, fixtures, and evidence. Use Write and Edit only for approved implementation or documentation changes. Do not call AssemblyAI, upload audio, open a streaming session, mint a token, replay a callback, deploy, rotate a key, or delete a transcript merely because this skill was invoked.

Approval Boundaries

Require an accountable owner before live audio processing, production credential or endpoint changes, paid model or capacity changes, content retention, callback replay, deployment, or deletion. Read-only repository inspection and synthetic offline validation do not authorize live vendor actions.

Failure Modes

Repeated 401 responses need credential-owner review, not logging the key.
Terminal transcript errors are not fixed by infinite polling.
Streaming reconnects must not overwrite the prior session.

Output

Return the operation scope, environment, region, contract surface, authorization class, model and feature decisions, deterministic validation results, content-free identifiers, risks, cleanup or rollback state, and a concise pass/fail receipt. Exclude credentials, si…

assemblyai-core-workflow-a View full skill →

Analyze and operate a production AssemblyAI pre-recorded pipeline with explicit models, Speech Understanding, callbacks, and retention controls.

ReadGlobGrepWriteEdit

AssemblyAI Governed Pre-recorded Pipeline

Overview

Operate pre-recorded transcription as an auditable asynchronous job. Keep live audio, credentials, spend, retention, and destructive state as separately governed boundaries.

Prerequisites

The target repository or integration path and the requested operator outcome.
The AssemblyAI project, environment, region, data classification, and accountable owner.
Current first-party documentation plus credentials only for a narrowly approved live check.

Current Contract

Submit to /v2/transcript with explicit speech_models; complete by bounded polling or authenticated webhook, then retrieve by transcript ID. Verify every intelligence, redaction, language, and prompting parameter against the selected current model. Route new LLM analysis to LLM Gateway, not deprecated transcript summary parameters.

Authentication

For live work, inject ASSEMBLYAI_API_KEY from an approved secret manager and send the raw value only in the AssemblyAI Authorization header to the configured first-party host. Never print, commit, place in a URL, or expose it to an untrusted client. Callback secrets and temporary streaming tokens are separate credentials.

Instructions

Confirm consent, purpose, region, language, and model policy.
Request only supported, approved transcription and understanding features.
Deliver audio without exposing storage credentials.
Persist transcript ID and an internal dedupe key after one submission.
Validate terminal status, duration, model, and redaction before release.
Propagate retention and deletion to every downstream copy.

Tool Discipline

Use Read, Glob, and Grep to inspect repository code, configuration, fixtures, and evidence. Use Write and Edit only for approved implementation or documentation changes. Do not call AssemblyAI, upload audio, open a streaming session, mint a token, replay a callback, deploy, rotate a key, or delete a transcript merely because this skill was invoked.

Approval Boundaries

Require an accountable owner before live audio processing, production credential or endpoint changes, paid model or capacity changes, content retention, callback replay, deployment, or deletion. Read-only repository inspection and synthetic offline validation do not authorize live vendor actions.

Failure Modes

Unsupported features require redesign, not silent omission.
Reconcile the ledger before resubmission to avoid duplicate cost.
Speaker labels remain pseudonymous unless identity mapping is separately approved.

Output

Return the operation scope, environment, region, contract surface, authorization class, model and feature decisions, deterministic validation results, content-free ide…

assemblyai-core-workflow-b View full skill →

Analyze and operate an AssemblyAI Streaming v3 session with safe tokens, audio framing, turn handling, and explicit termination.

ReadGlobGrepWriteEdit

AssemblyAI Streaming v3 Session

Overview

Operate live transcription around the current v3 message and billing lifecycle. Govern capture, credentials, finalized content, reconnects, and termination separately.

Prerequisites

The target repository or integration path and the requested operator outcome.
The AssemblyAI project, environment, region, data classification, and accountable owner.
Current first-party documentation plus credentials only for a narrowly approved live check.

Current Contract

Use wss://streaming.assemblyai.com/v3/ws or the approved residency host. Handle Begin, partial and finalized Turn messages, and Termination. Match encoding and sample rate, pace audio correctly, use backend-minted tokens in untrusted clients, and terminate explicitly so abandoned connections do not continue billing.

Authentication

For live work, inject ASSEMBLYAI_API_KEY from an approved secret manager and send the raw value only in the AssemblyAI Authorization header to the configured first-party host. Never print, commit, place in a URL, or expose it to an untrusted client. Callback secrets and temporary streaming tokens are separate credentials.

Instructions

Confirm live-capture consent, region, model, encoding, and turn policy.
Mint a short-lived single-use token for untrusted clients.
Verify Begin before sending correctly paced audio frames.
Order turns and persist only approved finalized content.
Treat reconnect as a new governed session boundary.
Send termination, await confirmation, stop capture, and record duration.

Tool Discipline

Use Read, Glob, and Grep to inspect repository code, configuration, fixtures, and evidence. Use Write and Edit only for approved implementation or documentation changes. Do not call AssemblyAI, upload audio, open a streaming session, mint a token, replay a callback, deploy, rotate a key, or delete a transcript merely because this skill was invoked.

Approval Boundaries

Require an accountable owner before live audio processing, production credential or endpoint changes, paid model or capacity changes, content retention, callback replay, deployment, or deletion. Read-only repository inspection and synthetic offline validation do not authorize live vendor actions.

Failure Modes

The /v2/realtime/ws route is legacy and must migrate.
Encoding or sample-rate mismatch is not repaired by retries.
Missing termination evidence leaves cost and completeness uncertain.

Output

Return the operation scope, environment, region, contract surface, authorization class, model and feature decisions, deterministic validation results, content-free identifiers, risks, cleanup …

assemblyai-cost-tuning View full skill →

Analyze and control AssemblyAI model, feature, duration, retry, concurrency, and LLM Gateway spend using measured usage.

ReadGlobGrepWriteEdit

AssemblyAI Spend and Usage Control

Overview

Control spend with dated prices and measured workload usage. Keep quality, privacy, reliability, credentials, and destructive state as separate gates.

Prerequisites

The target repository or integration path and the requested operator outcome.
The AssemblyAI project, environment, region, data classification, and accountable owner.
Current first-party documentation plus credentials only for a narrowly approved live check.

Current Contract

Pre-recorded billing follows successfully processed audio duration and selected models or add-ons; published guidance says failed transcripts are not charged. Streaming follows session duration, so termination matters. LLM Gateway has separate economics. Prices are time-sensitive and belong in reviewed billing inputs.

Authentication

For live work, inject ASSEMBLYAI_API_KEY from an approved secret manager and send the raw value only in the AssemblyAI Authorization header to the configured first-party host. Never print, commit, place in a URL, or expose it to an untrusted client. Callback secrets and temporary streaming tokens are separate credentials.

Instructions

Inventory audio and session duration, model mix, features, gateway use, retries, and duplicates.
Retrieve dated current prices and account reporting.
Attribute usage through internal job metadata rather than keys per customer.
Remove duplicate submissions, abandoned sessions, and needless polling.
Compare supported models against fixed quality and latency gates.
Set budgets, anomaly alerts, and hard ceilings for backfills and gateway work.

Tool Discipline

Use Read, Glob, and Grep to inspect repository code, configuration, fixtures, and evidence. Use Write and Edit only for approved implementation or documentation changes. Do not call AssemblyAI, upload audio, open a streaming session, mint a token, replay a callback, deploy, rotate a key, or delete a transcript merely because this skill was invoked.

Approval Boundaries

Require an accountable owner before live audio processing, production credential or endpoint changes, paid model or capacity changes, content retention, callback replay, deployment, or deletion. Read-only repository inspection and synthetic offline validation do not authorize live vendor actions.

Failure Modes

Stale price constants produce false forecasts.
Separate keys do not create separate account capacity.
Deletion reduces retention exposure but does not reverse processing cost.

Output

Return the operation scope, environment, region, contract surface, authorization class, model and feature decisions, deterministic validation results, content-free identifiers, risks, cleanup or rollback state, and a …

assemblyai-debug-bundle View full skill →

Produce a redacted AssemblyAI diagnostic bundle for support and incident triage.

ReadGlobGrepWriteEdit

AssemblyAI Privacy-safe Diagnostic Bundle

Overview

Produce a redacted AssemblyAI diagnostic bundle for support and incident triage. Treat live audio, transcript content, credentials, spend, and destructive state as separately governed boundaries.

Prerequisites

The target repository or integration path and the requested operator outcome.
The AssemblyAI project, environment, region, data classification, and accountable owner.
Current first-party documentation plus credentials only for a narrowly approved live check.

Current Contract

Allowlisted evidence includes hosts, SDK version, operation, models, hashed IDs, status transitions, timestamps, durations, response or close codes, delivery attempts, and termination state. Exclude authorization values, signed URLs, token responses, audio, transcript text, prompts, and full callback bodies by default.

Authentication

For live work, inject ASSEMBLYAI_API_KEY from an approved secret manager and send the raw value only in the AssemblyAI Authorization header to the configured first-party host. Never print, commit, place in a URL, or expose it to an untrusted client. Callback secrets and temporary streaming tokens are separate credentials.

Instructions

Define incident scope, audience, region, and evidence expiry.
Inventory logs before copying and label content-bearing fields.
Extract only allowlisted metadata and hash stable identifiers when useful.
Replace every secret or content field with a fixed marker.
Scan the staged bundle for secrets and speech-derived content.
Obtain review, transfer securely, and record destruction date.

Tool Discipline

Use Read, Glob, and Grep to inspect repository code, configuration, fixtures, and evidence. Use Write and Edit only for approved implementation or documentation changes. Do not call AssemblyAI, upload audio, open a streaming session, mint a token, replay a callback, deploy, rotate a key, or delete a transcript merely because this skill was invoked.

Approval Boundaries

Require an accountable owner before live audio processing, production credential or endpoint changes, paid model or capacity changes, content retention, callback replay, deployment, or deletion. Read-only repository inspection and synthetic offline validation do not authorize live vendor actions.

Failure Modes

Recursive environment dumps collect unrelated secrets.
Full vendor responses remain sensitive after key removal.
Hashing low-entropy personal values is not anonymization.

Output

Return the operation scope, environment, region, contract surface, authorization class, model and feature decisions, deterministic validation results, content-free identifiers, risks, cleanup or rollback state, and a concise pa…

assemblyai-deploy-integration View full skill →

Deploy AssemblyAI workers, Streaming v3 token services, and authenticated callback receivers with reversible controls.

ReadGlobGrepWriteEdit

AssemblyAI Reversible Deployment

Overview

Deploy AssemblyAI workers, Streaming v3 token services, and authenticated callback receivers with reversible controls. Treat live audio, transcript content, credentials, spend, and destructive state as separately governed boundaries.

Prerequisites

The target repository or integration path and the requested operator outcome.
The AssemblyAI project, environment, region, data classification, and accountable owner.
Current first-party documentation plus credentials only for a narrowly approved live check.

Current Contract

REST workers need HTTPS egress to the chosen regional host. Streaming needs WebSocket support and shutdown cleanup. Token issuance stays on a trusted backend. Callback ingress uses TLS, authentication, fast durable enqueue, deduplication, and dead-letter handling.

Authentication

For live work, inject ASSEMBLYAI_API_KEY from an approved secret manager and send the raw value only in the AssemblyAI Authorization header to the configured first-party host. Never print, commit, place in a URL, or expose it to an untrusted client. Callback secrets and temporary streaming tokens are separate credentials.

Instructions

Draw boundaries for clients, audio, token service, ingress, queue, workers, and stores.
Bind immutable region and environment keys from the secret manager.
Deploy callback ingress with auth, size limits, durable enqueue, and dedupe.
Deploy authorized token issuance with short expiry and quotas.
Configure worker concurrency, shutdown, retry, and retention.
Canary synthetic REST and v3 paths, then exercise rollback.

Tool Discipline

Use Read, Glob, and Grep to inspect repository code, configuration, fixtures, and evidence. Use Write and Edit only for approved implementation or documentation changes. Do not call AssemblyAI, upload audio, open a streaming session, mint a token, replay a callback, deploy, rotate a key, or delete a transcript merely because this skill was invoked.

Approval Boundaries

Require an accountable owner before live audio processing, production credential or endpoint changes, paid model or capacity changes, content retention, callback replay, deployment, or deletion. Read-only repository inspection and synthetic offline validation do not authorize live vendor actions.

Failure Modes

Some serverless platforms cannot hold long WebSockets.
Acknowledging before durable enqueue can lose work.
Rollback that leaves token issuance active does not contain traffic.

Output

Return the operation scope, environment, region, contract surface, authorization class, model and feature decisions, deterministic validation results, content-free identifiers, risks, cleanup or rollback state, and a …

assemblyai-hello-world View full skill →

Run a bounded AssemblyAI pre-recorded smoke test with explicit model fallback and safe output.

ReadGlobGrepWriteEdit

AssemblyAI Pre-recorded Smoke Test

Overview

Run a bounded AssemblyAI pre-recorded smoke test with explicit model fallback and safe output. Treat live audio, transcript content, credentials, spend, and destructive state as separately governed boundaries.

Prerequisites

The target repository or integration path and the requested operator outcome.
The AssemblyAI project, environment, region, data classification, and accountable owner.
Current first-party documentation plus credentials only for a narrowly approved live check.

Current Contract

Current pre-recorded requests require an explicit speech_models list; there is no default. Submit a consented fixture, keep its transcript ID as the job handle, and require a completed terminal state plus content-safe assertions before declaring success.

Authentication

For live work, inject ASSEMBLYAI_API_KEY from an approved secret manager and send the raw value only in the AssemblyAI Authorization header to the configured first-party host. Never print, commit, place in a URL, or expose it to an untrusted client. Callback secrets and temporary streaming tokens are separate credentials.

Instructions

Checksum a short synthetic fixture and record expected language.
Choose the regional host and supported ordered model list.
Submit once without logging keys or signed source URLs.
Poll with a deadline or consume an authenticated callback.
Verify status, plausible duration, selected model, and an expected phrase.
Delete the fixture transcript after the evidence window.

Tool Discipline

Use Read, Glob, and Grep to inspect repository code, configuration, fixtures, and evidence. Use Write and Edit only for approved implementation or documentation changes. Do not call AssemblyAI, upload audio, open a streaming session, mint a token, replay a callback, deploy, rotate a key, or delete a transcript merely because this skill was invoked.

Approval Boundaries

Require an accountable owner before live audio processing, production credential or endpoint changes, paid model or capacity changes, content retention, callback replay, deployment, or deletion. Read-only repository inspection and synthetic offline validation do not authorize live vendor actions.

Failure Modes

HTTP success proves submission, not successful transcription.
An inaccessible private URL needs an authorized delivery path, not public exposure.
Empty or implausible output fails the smoke test.

Output

Return the operation scope, environment, region, contract surface, authorization class, model and feature decisions, deterministic validation results, content-free identifiers, risks, cleanup or rollback state, and a concise pass/fail receipt. Exclude credentials…

assemblyai-install-auth View full skill →

Configure AssemblyAI keys, regional endpoints, and server-versus-browser authentication safely.

ReadGlobGrepWriteEdit

AssemblyAI Identity and Endpoint Setup

Overview

Configure AssemblyAI keys, regional endpoints, and server-versus-browser authentication safely. Treat live audio, transcript content, credentials, spend, and destructive state as separately governed boundaries.

Prerequisites

The target repository or integration path and the requested operator outcome.
The AssemblyAI project, environment, region, data classification, and accountable owner.
Current first-party documentation plus credentials only for a narrowly approved live check.

Current Contract

Pre-recorded REST uses the approved US or EU api.assemblyai.com host and the raw project key in the Authorization header. Streaming uses the v3 WebSocket host. Browser and mobile clients receive short-lived, single-use streaming tokens from a trusted backend; they never receive the project key.

Authentication

For live work, inject ASSEMBLYAI_API_KEY from an approved secret manager and send the raw value only in the AssemblyAI Authorization header to the configured first-party host. Never print, commit, place in a URL, or expose it to an untrusted client. Callback secrets and temporary streaming tokens are separate credentials.

Instructions

Inventory runtime trust, data class, region, and environment.
Pin the official SDK and centralize reviewed endpoint configuration.
Separate keys by environment and inject them from the secret manager.
Design an authorized, origin-limited token endpoint for untrusted clients.
Verify one synthetic pre-recorded request with explicit speech_models.
Record host, key-owner, rotation, token TTL, and redacted results.

Tool Discipline

Use Read, Glob, and Grep to inspect repository code, configuration, fixtures, and evidence. Use Write and Edit only for approved implementation or documentation changes. Do not call AssemblyAI, upload audio, open a streaming session, mint a token, replay a callback, deploy, rotate a key, or delete a transcript merely because this skill was invoked.

Approval Boundaries

Require an accountable owner before live audio processing, production credential or endpoint changes, paid model or capacity changes, content retention, callback replay, deployment, or deletion. Read-only repository inspection and synthetic offline validation do not authorize live vendor actions.

Failure Modes

Wrong-region traffic is a residency incident, not a retry.
A project key in browser code is compromised and must be rotated.
Do not add an undocumented Bearer scheme to the REST authorization value.

Output

Return the operation scope, environment, region, contract surface, authorization class, model and feature decisions, deterministic validation res…

assemblyai-local-dev-loop View full skill →

Build an AssemblyAI local loop with synthetic fixtures, recorded contracts, and an optional bounded live lane.

ReadGlobGrepWriteEdit

AssemblyAI Deterministic Local Development

Overview

Build an AssemblyAI local loop with synthetic fixtures, recorded contracts, and an optional bounded live lane. Treat live audio, transcript content, credentials, spend, and destructive state as separately governed boundaries.

Prerequisites

The target repository or integration path and the requested operator outcome.
The AssemblyAI project, environment, region, data classification, and accountable owner.
Current first-party documentation plus credentials only for a narrowly approved live check.

Current Contract

Ordinary development stays offline. Fixtures model REST job states, Streaming v3 messages, both webhook families, LLM Gateway outputs, throttling, duplicates, and termination. A public tunnel and live API call are explicit exposure and cost boundaries.

Authentication

For live work, inject ASSEMBLYAI_API_KEY from an approved secret manager and send the raw value only in the AssemblyAI Authorization header to the configured first-party host. Never print, commit, place in a URL, or expose it to an untrusted client. Callback secrets and temporary streaming tokens are separate credentials.

Instructions

Map the adapter surfaces actually used.
Create synthetic audio and content-free response fixtures.
Inject a fake clock, deterministic jitter, and bounded queues.
Cover delayed polling, 429, duplicates, malformed events, and disconnects.
Protect live tests behind a separate flag and secret context.
Review recorded-contract diffs against current first-party schemas.

Tool Discipline

Use Read, Glob, and Grep to inspect repository code, configuration, fixtures, and evidence. Use Write and Edit only for approved implementation or documentation changes. Do not call AssemblyAI, upload audio, open a streaming session, mint a token, replay a callback, deploy, rotate a key, or delete a transcript merely because this skill was invoked.

Approval Boundaries

Require an accountable owner before live audio processing, production credential or endpoint changes, paid model or capacity changes, content retention, callback replay, deployment, or deletion. Read-only repository inspection and synthetic offline validation do not authorize live vendor actions.

Failure Modes

A default test that needs a live key is not deterministic.
Real transcript text does not belong in golden fixtures.
A tunnel must be authenticated, disposable, and explicitly approved.

Output

Return the operation scope, environment, region, contract surface, authorization class, model and feature decisions, deterministic validation results, content-free identifiers, risks, cleanup or rollback state, and a concise pass/fail receipt. Exclude credentials, sign…

assemblyai-performance-tuning View full skill →

Analyze and tune AssemblyAI model choice, audio delivery, polling, Streaming v3 turns, concurrency, and downstream work.

ReadGlobGrepWriteEdit

AssemblyAI Latency and Throughput Tuning

Overview

Tune latency and throughput with controlled, representative experiments. Preserve accuracy, privacy, credentials, spend, and rollback as separate gates.

Prerequisites

The target repository or integration path and the requested operator outcome.
The AssemblyAI project, environment, region, data classification, and accountable owner.
Current first-party documentation plus credentials only for a narrowly approved live check.

Current Contract

Pre-recorded and streaming optimize different outcomes. Current models differ in languages, accuracy, latency, prompting, endpointing, and price. Benchmark representative approved fixtures rather than inherited labels such as Best or Nano, and keep privacy, quality, and spend as co-equal gates.

Authentication

For live work, inject ASSEMBLYAI_API_KEY from an approved secret manager and send the raw value only in the AssemblyAI Authorization header to the configured first-party host. Never print, commit, place in a URL, or expose it to an untrusted client. Callback secrets and temporary streaming tokens are separate credentials.

Instructions

Define queue, completion, first-turn, finalization, quality, and cost objectives.
Build a representative synthetic or approved evaluation set.
Benchmark current supported models and only required features.
Replace aggressive polling with callbacks and tune admission separately.
Verify audio format, pacing, turn settings, and termination for streaming.
Canary one change at a time and retain rollback thresholds.

Tool Discipline

Use Read, Glob, and Grep to inspect repository code, configuration, fixtures, and evidence. Use Write and Edit only for approved implementation or documentation changes. Do not call AssemblyAI, upload audio, open a streaming session, mint a token, replay a callback, deploy, rotate a key, or delete a transcript merely because this skill was invoked.

Approval Boundaries

Require an accountable owner before live audio processing, production credential or endpoint changes, paid model or capacity changes, content retention, callback replay, deployment, or deletion. Read-only repository inspection and synthetic offline validation do not authorize live vendor actions.

Failure Modes

Faster output with unacceptable accuracy is a regression.
Audio preprocessing can introduce harmful artifacts.
Lower latency with more retries or abandoned sessions is not an improvement.

Output

Return the operation scope, environment, region, contract surface, authorization class, model and feature decisions, deterministic validation results, content-free identifiers, risks, cleanup or rollback state, and a concise pass/fail receipt. Exclude…

assemblyai-prod-checklist View full skill →

Analyze and gate an AssemblyAI integration across contracts, security, reliability, cost, observability, retention, and rollback.

ReadGlobGrepWriteEdit

AssemblyAI Production Readiness Gate

Overview

Gate production on evidence across the entire AssemblyAI lifecycle. Treat data, credentials, spend, deployment, rollback, and deletion as separately owned boundaries.

Prerequisites

The target repository or integration path and the requested operator outcome.
The AssemblyAI project, environment, region, data classification, and accountable owner.
Current first-party documentation plus credentials only for a narrowly approved live check.

Current Contract

Production requires current REST and Streaming v3 contracts, explicit models, protected keys and tokens, authenticated idempotent callbacks, bounded retries, explicit streaming termination, deletion propagation, cost controls, monitoring, and tested rollback. One happy-path transcript is insufficient.

Authentication

For live work, inject ASSEMBLYAI_API_KEY from an approved secret manager and send the raw value only in the AssemblyAI Authorization header to the configured first-party host. Never print, commit, place in a URL, or expose it to an untrusted client. Callback secrets and temporary streaming tokens are separate credentials.

Instructions

Record release, owners, regions, data classes, surfaces, and rollback target.
Verify secrets, consent, token issuance, callbacks, and retention.
Test success, terminal error, 429, duplicate, malformed event, reconnect, and termination offline.
Run one budgeted live synthetic canary in the approved region.
Verify alerts for queue age, failures, throttling, delivery, sessions, and spend.
Exercise rollback and publish an expiring pass or fail receipt.

Tool Discipline

Use Read, Glob, and Grep to inspect repository code, configuration, fixtures, and evidence. Use Write and Edit only for approved implementation or documentation changes. Do not call AssemblyAI, upload audio, open a streaming session, mint a token, replay a callback, deploy, rotate a key, or delete a transcript merely because this skill was invoked.

Approval Boundaries

Require an accountable owner before live audio processing, production credential or endpoint changes, paid model or capacity changes, content retention, callback replay, deployment, or deletion. Read-only repository inspection and synthetic offline validation do not authorize live vendor actions.

Failure Modes

A health endpoint that never submits audio is not integration evidence.
Customer audio is not a synthetic production test.
An alert without an owner and response action is not ready.

Output

Return the operation scope, environment, region, contract surface, authorization class, model and feature decisions, deterministic validation results, content-free identifiers, risks, cleanup or rollb…

assemblyai-rate-limits View full skill →

Analyze and control AssemblyAI account request limits, concurrency, backoff, and admission queues.

ReadGlobGrepWriteEdit

AssemblyAI Capacity and Retry Control

Overview

Control capacity with explicit account limits, queues, and retry budgets. Keep data, credentials, spend, and replay decisions separately governed.

Prerequisites

The target repository or integration path and the requested operator outcome.
The AssemblyAI project, environment, region, data classification, and accountable owner.
Current first-party documentation plus credentials only for a narrowly approved live check.

Current Contract

AssemblyAI documents 20,000 API requests per five minutes plus operation-specific concurrency limits. Limits apply at account level; project keys mirror capacity rather than multiply it. Actual concurrency and autoscaling are account-specific, so use current dashboard and documentation evidence.

Authentication

For live work, inject ASSEMBLYAI_API_KEY from an approved secret manager and send the raw value only in the AssemblyAI Authorization header to the configured first-party host. Never print, commit, place in a URL, or expose it to an untrusted client. Callback secrets and temporary streaming tokens are separate credentials.

Instructions

Inventory submissions, polls, callbacks, gateway calls, and streaming concurrency.
Record current account limits and observed headers.
Allocate separate bounded pools by operation class.
Prefer callbacks to aggressive polling and use durable admission queues.
Honor Retry-After or capped exponential backoff with jitter.
Reconcile transcript IDs before retrying submission and alert on saturation.

Tool Discipline

Use Read, Glob, and Grep to inspect repository code, configuration, fixtures, and evidence. Use Write and Edit only for approved implementation or documentation changes. Do not call AssemblyAI, upload audio, open a streaming session, mint a token, replay a callback, deploy, rotate a key, or delete a transcript merely because this skill was invoked.

Approval Boundaries

Require an accountable owner before live audio processing, production credential or endpoint changes, paid model or capacity changes, content retention, callback replay, deployment, or deletion. Read-only repository inspection and synthetic offline validation do not authorize live vendor actions.

Failure Modes

More keys do not create more account capacity.
Auth and validation failures are not retryable.
Unbounded polling amplifies outages and competes with submissions.

Output

Return the operation scope, environment, region, contract surface, authorization class, model and feature decisions, deterministic validation results, content-free identifiers, risks, cleanup or rollback state, and a concise pass/fail receipt. Exclude credentials, signed URLs, audio, tra…

assemblyai-reference-architecture View full skill →

Analyze and design an AssemblyAI architecture spanning pre-recorded jobs, Streaming v3, LLM Gateway, callbacks, queues, retention, and audit evidence.

ReadGlobGrepWriteEdit

AssemblyAI Governed Reference Architecture

Overview

Design explicit trust and lifecycle boundaries for ingestion, jobs, live turns, analysis, and deletion. Keep data, credentials, region, spend, and destructive state visible.

Prerequisites

The target repository or integration path and the requested operator outcome.
The AssemblyAI project, environment, region, data classification, and accountable owner.
Current first-party documentation plus credentials only for a narrowly approved live check.

Current Contract

Pre-recorded jobs are asynchronous resources addressed by transcript ID. Streaming v3 is a stateful billed session requiring termination. LLM Gateway is a separate analysis plane replacing LeMUR. Callback payloads differ by family. Region, principal, credential, retention, and deletion remain visible on every edge.

Authentication

For live work, inject ASSEMBLYAI_API_KEY from an approved secret manager and send the raw value only in the AssemblyAI Authorization header to the configured first-party host. Never print, commit, place in a URL, or expose it to an untrusted client. Callback secrets and temporary streaming tokens are separate credentials.

Instructions

Capture use cases, SLOs, languages, data classes, consent, region, retention, and cost.
Separate audio ingress, submitter, v3 gateway, token issuer, callback ingress, queues, workers, and stores.
Assign each edge a principal, credential, host, timeout, retry budget, and schema.
Model job and session states including duplicates, reconnect, failure, and termination.
Place LLM Gateway behind prompt allowlists and output schemas.
Map deletion through vendor, storage, databases, caches, search, and analytics.

Tool Discipline

Use Read, Glob, and Grep to inspect repository code, configuration, fixtures, and evidence. Use Write and Edit only for approved implementation or documentation changes. Do not call AssemblyAI, upload audio, open a streaming session, mint a token, replay a callback, deploy, rotate a key, or delete a transcript merely because this skill was invoked.

Approval Boundaries

Require an accountable owner before live audio processing, production credential or endpoint changes, paid model or capacity changes, content retention, callback replay, deployment, or deletion. Read-only repository inspection and synthetic offline validation do not authorize live vendor actions.

Failure Modes

One opaque method cannot safely hide REST jobs and streaming sessions.
Polling in request handlers couples scaling and timeouts.
A design without credential, failure, rollback, and deletion paths is incomplete.

Output

Return the operation scope, environment, region, contract surface, authorization class, …

assemblyai-sdk-patterns View full skill →

Analyze and design a typed AssemblyAI adapter that isolates SDK drift, regional routing, polling, and streaming lifecycles.

ReadGlobGrepWriteEdit

AssemblyAI Typed Adapter Boundary

Overview

Design a narrow application-owned boundary around the current SDK. Keep data, credentials, region, retries, spend, and destructive state separately governed.

Prerequisites

The target repository or integration path and the requested operator outcome.
The AssemblyAI project, environment, region, data classification, and accountable owner.
Current first-party documentation plus credentials only for a narrowly approved live check.

Current Contract

Pre-recorded jobs, Streaming v3 sessions, temporary-token issuance, webhooks, and LLM Gateway requests have different lifecycles. Keep vendor objects behind a narrow application-owned port. New code must not expose legacy LeMUR methods or Streaming v2 service names.

Authentication

For live work, inject ASSEMBLYAI_API_KEY from an approved secret manager and send the raw value only in the AssemblyAI Authorization header to the configured first-party host. Never print, commit, place in a URL, or expose it to an untrusted client. Callback secrets and temporary streaming tokens are separate credentials.

Instructions

Inventory direct SDK imports and classify each surface.
Define narrow request, result, and stable application-error types.
Centralize immutable region, authentication, deadlines, and retry policy.
Separate job submission from completion retrieval.
Model streaming connect, begin, turns, termination, and confirmation.
Pin the SDK and prove the boundary with contract fixtures.

Tool Discipline

Use Read, Glob, and Grep to inspect repository code, configuration, fixtures, and evidence. Use Write and Edit only for approved implementation or documentation changes. Do not call AssemblyAI, upload audio, open a streaming session, mint a token, replay a callback, deploy, rotate a key, or delete a transcript merely because this skill was invoked.

Approval Boundaries

Require an accountable owner before live audio processing, production credential or endpoint changes, paid model or capacity changes, content retention, callback replay, deployment, or deletion. Read-only repository inspection and synthetic offline validation do not authorize live vendor actions.

Failure Modes

Mutable tenant state in a singleton can cross-contaminate requests.
Catch-all retries can duplicate billed work.
Vendor response objects crossing service boundaries make upgrades unsafe.

Output

Return the operation scope, environment, region, contract surface, authorization class, model and feature decisions, deterministic validation results, content-free identifiers, risks, cleanup or rollback state, and a concise pass/fail receipt. Exclude credentials, signed URLs, audio, transcript text, prompts, and custo…

assemblyai-security-basics View full skill →

Analyze and apply AssemblyAI secret, region, consent, retention, deletion, and model-training controls.

ReadGlobGrepWriteEdit

AssemblyAI Security and Data Governance

Overview

Govern speech and derived data across every AssemblyAI surface. Keep consent, credentials, region, training posture, retention, and deletion as explicit decisions.

Prerequisites

The target repository or integration path and the requested operator outcome.
The AssemblyAI project, environment, region, data classification, and accountable owner.
Current first-party documentation plus credentials only for a narrowly approved live check.

Current Contract

Speech, transcripts, prompts, and derived intelligence are governed data. Long-lived keys stay server-side; US and EU hosts are explicit decisions. Retention, training posture, transcript deletion, and downstream copies require policy evidence. Infrastructure TTL processing means physical deletion should not be described as instantaneous without confirmation.

Authentication

For live work, inject ASSEMBLYAI_API_KEY from an approved secret manager and send the raw value only in the AssemblyAI Authorization header to the configured first-party host. Never print, commit, place in a URL, or expose it to an untrusted client. Callback secrets and temporary streaming tokens are separate credentials.

Instructions

Classify every source and derived data field.
Confirm consent, purpose, region, training posture, and subprocessors.
Separate, store, rotate, and monitor environment keys.
Use temporary browser tokens and a separate callback secret.
Minimize requested features, persisted fields, and broad access.
Delete and reconcile AssemblyAI plus every downstream copy.

Tool Discipline

Use Read, Glob, and Grep to inspect repository code, configuration, fixtures, and evidence. Use Write and Edit only for approved implementation or documentation changes. Do not call AssemblyAI, upload audio, open a streaming session, mint a token, replay a callback, deploy, rotate a key, or delete a transcript merely because this skill was invoked.

Approval Boundaries

Require an accountable owner before live audio processing, production credential or endpoint changes, paid model or capacity changes, content retention, callback replay, deployment, or deletion. Read-only repository inspection and synthetic offline validation do not authorize live vendor actions.

Failure Modes

Deleting the vendor transcript does not remove downstream copies.
PII redaction does not replace consent or authorization.
A client-side project key is compromised even in a private repository.

Output

Return the operation scope, environment, region, contract surface, authorization class, model and feature decisions, deterministic validation results, content-free identifiers, risks, cleanup or rollback state, and a concise …

assemblyai-upgrade-migration View full skill →

Migrate legacy AssemblyAI Streaming v2 and LeMUR integrations to Streaming v3 and LLM Gateway with parity evidence.

ReadGlobGrepWriteEdit

AssemblyAI v3 and LLM Gateway Migration

Overview

Migrate legacy AssemblyAI Streaming v2 and LeMUR integrations to Streaming v3 and LLM Gateway with parity evidence. Treat live audio, transcript content, credentials, spend, and destructive state as separately governed boundaries.

Prerequisites

The target repository or integration path and the requested operator outcome.
The AssemblyAI project, environment, region, data classification, and accountable owner.
Current first-party documentation plus credentials only for a narrowly approved live check.

Current Contract

Streaming v2 used /v2/realtime/ws; v3 uses /v3/ws with different messages, turns, configuration, and termination. LeMUR sunset on March 31, 2026; LLM Gateway is the current analysis path. Deprecated transcript summary parameters must not anchor new designs.

Authentication

For live work, inject ASSEMBLYAI_API_KEY from an approved secret manager and send the raw value only in the AssemblyAI Authorization header to the configured first-party host. Never print, commit, place in a URL, or expose it to an untrusted client. Callback secrets and temporary streaming tokens are separate credentials.

Instructions

Inventory endpoints, SDK methods, handlers, fixtures, dashboards, and legacy credentials.
Capture approved legacy behavior with synthetic golden cases.
Map v2 messages and shutdown to v3 begin, turns, configuration, and termination.
Map LeMUR prompts and outputs to schema-constrained LLM Gateway requests.
Compare quality, latency, structured results, privacy, and cost.
Canary the new route, test rollback, then remove legacy code and secrets.

Tool Discipline

Use Read, Glob, and Grep to inspect repository code, configuration, fixtures, and evidence. Use Write and Edit only for approved implementation or documentation changes. Do not call AssemblyAI, upload audio, open a streaming session, mint a token, replay a callback, deploy, rotate a key, or delete a transcript merely because this skill was invoked.

Approval Boundaries

Require an accountable owner before live audio processing, production credential or endpoint changes, paid model or capacity changes, content retention, callback replay, deployment, or deletion. Read-only repository inspection and synthetic offline validation do not authorize live vendor actions.

Failure Modes

Changing only the WebSocket URL leaves v2 handlers broken.
LeMUR calls after sunset are a hard migration defect.
LLM parity needs semantic and schema assertions, not byte equality.

Output

Return the operation scope, environment, region, contract surface, authorization class, model and feature decisions, deterministic validation results, content-fr…

assemblyai-webhooks-events View full skill →

Analyze and process AssemblyAI pre-recorded and streaming webhooks with authentication, fast acknowledgment, deduplication, and safe retrieval.

ReadGlobGrepWriteEdit

AssemblyAI Authenticated Webhook Processing

Overview

Process callbacks as authenticated, repeatable delivery attempts. Keep acknowledgment, content retrieval, persistence, replay, credentials, and deletion separately governed.

Prerequisites

The target repository or integration path and the requested operator outcome.
The AssemblyAI project, environment, region, data classification, and accountable owner.
Current first-party documentation plus credentials only for a narrowly approved live check.

Current Contract

Pre-recorded callbacks carry transcript ID and status; fetch the full transcript separately. Streaming callbacks after termination can carry finalized turns. AssemblyAI documents a 10-second acknowledgment window and up to 10 attempts when no 2xx is received; a 4xx stops retries. Verify the configured custom auth header.

Authentication

For live work, inject ASSEMBLYAI_API_KEY from an approved secret manager and send the raw value only in the AssemblyAI Authorization header to the configured first-party host. Never print, commit, place in a URL, or expose it to an untrusted client. Callback secrets and temporary streaming tokens are separate credentials.

Instructions

Bind each route to the correct event schema.
Capture bounded raw bytes and verify the auth header before parsing.
Validate content type and allowlisted fields.
Derive a durable dedupe key from family and stable identity.
Persist approved minimized data, then return 2xx within deadline.
Retrieve pre-recorded results by ID and quarantine schema drift.

Tool Discipline

Use Read, Glob, and Grep to inspect repository code, configuration, fixtures, and evidence. Use Write and Edit only for approved implementation or documentation changes. Do not call AssemblyAI, upload audio, open a streaming session, mint a token, replay a callback, deploy, rotate a key, or delete a transcript merely because this skill was invoked.

Approval Boundaries

Require an accountable owner before live audio processing, production credential or endpoint changes, paid model or capacity changes, content retention, callback replay, deployment, or deletion. Read-only repository inspection and synthetic offline validation do not authorize live vendor actions.

Failure Modes

A transient 4xx can cause permanent loss because retries stop.
IP allowlisting supplements but does not replace callback auth.
Duplicate delivery must not duplicate downstream actions.

Output

Return the operation scope, environment, region, contract surface, authorization class, model and feature decisions, deterministic validation results, content-free identifiers, risks, cleanup or rollback state, and a concise pass/fail receipt. Exclude credentials, …

assemblyai-pack

Installation

What It Does

Skills (18) plugin-local skills

AssemblyAI Contract-safe CI

Overview

Prerequisites

Current Contract

Authentication

Instructions

Tool Discipline

Approval Boundaries

Failure Modes

Output

AssemblyAI Failure Triage

Overview

Prerequisites

Current Contract

Authentication

Instructions

Tool Discipline

Approval Boundaries

Failure Modes

Output

AssemblyAI Governed Pre-recorded Pipeline

Overview

Prerequisites

Current Contract

Authentication

Instructions

Tool Discipline

Approval Boundaries

Failure Modes

Output

AssemblyAI Streaming v3 Session

Overview

Prerequisites

Current Contract

Authentication

Instructions

Tool Discipline

Approval Boundaries

Failure Modes

Output

AssemblyAI Spend and Usage Control

Overview

Prerequisites

Current Contract

Authentication

Instructions

Tool Discipline

Approval Boundaries

Failure Modes

Output

AssemblyAI Privacy-safe Diagnostic Bundle

Overview

Prerequisites

Current Contract

Authentication

Instructions

Tool Discipline

Approval Boundaries

Failure Modes

Output

AssemblyAI Reversible Deployment

Overview

Prerequisites

Current Contract

Authentication

Instructions

Tool Discipline

Approval Boundaries

Failure Modes

Output

AssemblyAI Pre-recorded Smoke Test

Overview

Prerequisites

Current Contract

Authentication

Instructions