PodcastIndex

Search and retrieve podcast and episode details from Podcast Index API using keywords, titles, feed IDs, URLs, or featured persons with authenticated requests.

Security Scan

The SKILL.md clearly requires a Podcast Index API key and secret and gives authenticated request instructions, but the registry metadata claims no required environment variables — this inconsistency should be resolved before trusting the skill.

Purpose & Capability

The skill's stated purpose (searching Podcast Index) aligns with the actions described in SKILL.md (authenticated GET requests to api.podcastindex.org). Requiring PODCASTINDEX_API_KEY and PODCASTINDEX_API_SECRET is proportionate to that purpose. However, the registry metadata provided earlier in the listing shows no required env vars while the SKILL.md includes an embedded 'openclaw' metadata block declaring those env vars and primaryEnv. That mismatch is an incoherence the developer should fix.

Instruction Scope

SKILL.md instructions are narrowly scoped to building authenticated requests to the Podcast Index API (timestamp + SHA-1 hash, include headers, call endpoints). It does not instruct reading arbitrary files or unrelated credentials, nor to exfiltrate data to other endpoints. It does reference using Node.js modules as an implementation hint but also suggests using a built-in HTTP request tool.

Install Mechanism

There is no install spec and no code files; this is instruction-only, so nothing will be written to disk by an installer. That is lower risk and consistent with the skill's content.

Credentials

The SKILL.md requires two secrets (PODCASTINDEX_API_KEY and PODCASTINDEX_API_SECRET), which are appropriate for Podcast Index authentication. The concern is that the skill registry metadata (the top-level requirements shown to users) lists no required env vars — this omission is misleading and could cause a user to unknowingly provide credentials without realizing the skill needs them. The skill also claims primaryEnv in its embedded metadata, further highlighting the discrepancy.

Persistence & Privilege

The skill does not request permanent presence (always: false) and does not request to modify other skills or system-wide settings. Autonomous invocation is allowed (default) but that is normal for skills; nothing here amplifies privilege beyond normal behavior.

What to consider before installing

This skill appears to do what it says (talk to Podcast Index) and legitimately needs an API key and secret, but the registry listing you saw omitted those required env vars while SKILL.md includes them. Before installing: 1) verify the skill's source/homepage or ask the publisher to fix the registry metadata so required env vars are visible; 2) only provide PODCASTINDEX_API_KEY and PODCASTINDEX_API_SECRET if you trust the skill and the publisher; 3) prefer using a limited-scope/rotatable key if Podcast Index supports it and rotate keys after testing; 4) if you are uncomfortable with autonomous invocation, restrict the skill or require manual invocation; and 5) ask the developer to publish code or a trustworthy homepage so you can audit behavior further.

name: podcast-index description: Access and search podcast information using the Podcast Index API, including searching for podcasts, episodes, and retrieving details. homepage: https://podcastindex.org/api/docs metadata: {“openclaw”:{“requires”:{“env”:[“PODCASTINDEX_API_KEY”,“PODCASTINDEX_API_SECRET”]},“primaryEnv”:“PODCASTINDEX_API_KEY”,“emoji”:“🎙️”}} This skill allows you to interact with the Podcast Index API to search for podcasts, retrieve podcast and episode details, and more. Use this when the user asks for podcast recommendations, episode information, or searches related to podcasts. Prerequisites • Ensure PODCASTINDEX_API_KEY and PODCASTINDEX_API_SECRET are set in the environment or config. • All requests must be authenticated with specific headers. • Base URL: https://api.podcastindex.org/api/1.0 Authentication To authenticate a request: 1 Get the current Unix timestamp: unixTime = Math.floor(Date.now() / 1000) 2 Compute the SHA-1 hash: hash = crypto.createHash('sha1').update(PODCASTINDEX_API_KEY + PODCASTINDEX_API_SECRET + unixTime.toString()).digest('hex') 3 Include these headers in every request: ◦ User-Agent: OpenClaw/1.0 (or a suitable identifier) ◦ X-Auth-Key: [PODCASTINDEX_API_KEY] ◦ X-Auth-Date: [unixTime] ◦ Authorization: [hash] Use the built-in HTTP request tool (e.g., fetch or http_get) to send GET requests with these headers. If executing code, use Node.js modules like ‘node-fetch’ and ‘crypto’. Key Endpoints and Usage • Search Podcasts by Term: Use when searching for podcasts by keywords in title, author, or owner. ◦ Endpoint: GET /search/byterm?q=[query]&[optional params like max=10, fulltext=true] ◦ Example: To find podcasts about “AI”, request /search/byterm?q=AI • Search Podcasts by Title: Use for exact title matches. ◦ Endpoint: GET /search/bytitle?q=[query] • Search Episodes by Person: Use to find episodes featuring a specific person. ◦ Endpoint: GET /search/byperson?q=[person name] • Get Podcast by Feed ID: Use to retrieve full podcast details by its Podcast Index ID. ◦ Endpoint: GET /podcasts/byfeedid?id=[feedId] • Get Podcast by Feed URL: Use to retrieve details by RSS feed URL. ◦ Endpoint: GET /podcasts/byfeedurl?url=[encoded feed URL] • Get Episodes by Feed ID: Use to get a list of episodes for a podcast. ◦ Endpoint: GET /episodes/byfeedid?id=[feedId]&[max=10] • Get Episode by ID: Use for single episode metadata. ◦ Endpoint: GET /episodes/byid?id=[episodeId] • Trending Podcasts: Use for popular podcasts. ◦ Endpoint: GET /podcasts/trending?[cat=technology&max=10] • Recent Episodes: Use for newly released episodes. ◦ Endpoint: GET /recent/episodes?max=10 Always parse the JSON response and summarize relevant information for the user. If the request fails, check authentication and retry. Add ?pretty to URLs for readable output during testing.