audiobooklm-podcast

AdvisoryAudited by Static analysis on May 7, 2026.

Overview

No suspicious patterns detected.

Findings (0)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

What this means

Approved actions may create or publish content in the user’s Ximalaya account and may consume service credits or incur platform costs.

Why it was flagged

The skill can create synthesis tasks, mix audio, and upload audio to an album, which are account-affecting actions. It also requires confirmation before tool calls, so this is disclosed and purpose-aligned rather than suspicious.

Skill content
工具调用前必须先问用户确认,禁止自动决定 ... chapter_task_create ... chapter_audio_mix ... upload_audio_to_album(album_id=<album_id>, audio_url=<第8步返回的audio_url>)
Recommendation

Confirm the exact book, chapter, voice, album, and any cost implications before approving generation or upload actions.

What this means

Anyone with the token may be able to access or modify content through the connected service according to that token’s permissions.

Why it was flagged

The skill requires a Bearer API token for the external MCP service. This is expected for the integration, but the token is an account credential and should be handled carefully.

Skill content
创建制作组,生成 API Token ... "Authorization": "Bearer <Token>"
Recommendation

Use a scoped, revocable token if available, store it only in the MCP configuration, and avoid pasting real tokens into ordinary chat messages.

What this means

Private scripts, drafts, or generated audio may be processed and stored by the external service as books, chapters, audio files, or album content.

Why it was flagged

The workflow sends user-provided script text to a remote MCP service for import and audio generation. This is central to the purpose, but it means content leaves the local agent environment.

Skill content
"url": "https://aigc.ximalaya.com/audiobooklm/mcp" ... podcast_import(... script_lines=["文本1", "文本2", ...])
Recommendation

Only submit content you are comfortable processing on the provider’s platform, and review the provider’s privacy, retention, and publication settings before using it for sensitive material.