ClawHub
Back to skill

Security audit

AI播客生成器

Security checks across malware telemetry and agentic risk

Overview

This skill is a disclosed MagicPodcast connector that sends user-approved text or PDF URLs to an external podcast service.

Install only if you are comfortable sending selected text or PDF URLs to MagicPodcast for processing. Avoid sensitive documents unless you explicitly approve external processing, keep the API key private, and confirm MAGICPODCAST_API_URL points to the intended MagicPodcast service.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

External Transmission

Medium
Category
Data Exfiltration
Content
payload="$(jq -n --arg pdfUrl "$PDF_URL" --arg language "$LANGUAGE" '{pdfUrl:$pdfUrl,language:$language}')"

curl -sS -X POST "$MAGICPODCAST_API_URL/agent/v1/podcasts/pdf" \
  -H "Content-Type: application/json" \
  -H "x-api-key: $MAGICPODCAST_API_KEY" \
  --data-binary "$payload"
Confidence
60% confidence
Finding
curl -sS -X POST "$MAGICPODCAST_API_URL/agent/v1/podcasts/pdf" \ -H "Content-Type: application/json" \ -H "x-api-key: $MAGICPODCAST_API_KEY" \ --data-binary "$payload" ``` Create from text: ``

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.