Security audit
Security checks for vulnerabilities and agentic risk
This skill is a straightforward guide for publishing text as podcast audio, but users should understand the text is sent to cast0.ai and auto-published to a public RSS feed.
Install only if you intend to publish supplied text as podcast audio. Treat any episode text as public, confirm before creating an episode, and store the CAST0_API_KEY securely rather than committing it to source control.
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Each API key is tied to one podcast. Once you have the key, save it:
echo "CAST0_API_KEY=pk_xxxxx" >> .env
The skill prominently markets one-call episode creation but does not warn at the point of use that created content is automatically published to a public RSS feed. This can cause users or downstream agents to send sensitive, draft, or internal text to a publicly accessible distribution channel without informed consent.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
**Base URL:** `https://api.cast0.ai`
**Auth:** `Authorization: Bearer pk_xxxxx`
**Docs:** `https://api.cast0.ai/docs`
## Setup
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
**Base URL:** `https://api.cast0.ai`
**Auth:** `Authorization: Bearer pk_xxxxx`
**Docs:** `https://api.cast0.ai/docs`
## Setup
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
**Base URL:** `https://api.cast0.ai`
**Auth:** `Authorization: Bearer pk_xxxxx`
**Docs:** `https://api.cast0.ai/docs`
## Setup
The create-episode example demonstrates outbound transmission of user content to a remote service. Because this skill auto-publishes generated episodes to a public RSS feed, the transmission is more dangerous than ordinary cloud processing and can lead to unintended public disclosure.
curl -X POST https://api.cast0.ai/api/episodes \
-H "Authorization: Bearer pk_xxxxx" \
-H "Content-Type: application/json" \
-d '{"title": "Daily Standup", "text": "Here is what happened today..."}'
The create-episode example demonstrates outbound transmission of user content to a remote service. Because this skill auto-publishes generated episodes to a public RSS feed, the transmission is more dangerous than ordinary cloud processing and can lead to unintended public disclosure.
curl -X POST https://api.cast0.ai/api/episodes \
-H "Authorization: Bearer pk_xxxxx" \
-H "Content-Type: application/json" \
-d '{"title": "Daily Standup", "text": "Here is what happened today..."}'
The skill documents that each podcast has a public no-auth RSS feed, which means generated content is accessible to anyone with the feed token and consumable by podcast apps. In context, this public exposure materially raises the impact of accidental submission of confidential or sensitive text.
Every podcast has a public feed URL (no auth):
https://api.cast0.ai/rss/FEED_TOKEN
Subscribe in any podcast app. New episodes appear automatically after generation.
No suspicious patterns detected.