Back to skill
Skillv1.0.0
ClawScan security
Transistor FM · ClawHub's context-aware review of the artifact, metadata, and declared behavior.
Scanner verdict
SuspiciousFeb 26, 2026, 8:17 AM
- Verdict
- suspicious
- Confidence
- medium
- Model
- gpt-5-mini
- Summary
- The skill's instructions match a Transistor.fm management purpose, but there are mismatches and ambiguous instructions around credentials and referenced files that could lead to unintended secret access or runtime surprises.
- Guidance
- This skill appears to do what it says (manage Transistor.fm via their API) but there are important inconsistencies and missing provenance you should address before installing. Specifically: (1) the SKILL.md requires an API key (it suggests TRANSISTOR_API_KEY) but the registry metadata doesn't declare it — treat that as a red flag and assume the agent will need that secret. (2) The doc refers to a missing references/api.md and uses undefined variables ($BASE, $KEY), so test in a safe environment first. (3) Avoid granting the agent broad access to a secrets manager; instead provide only the Transistor API key and only to the skill's scope if possible. (4) Because the skill's source/homepage are unknown, prefer to use an official or well-documented plugin from a trusted publisher, or manually implement the minimal curl commands yourself. If you proceed, limit the agent's secret access to a single TRANSISTOR_API_KEY and monitor requests to ensure it only calls api.transistor.fm and uploads files you expect.
Review Dimensions
- Purpose & Capability
- okName and description describe Transistor.fm podcast management and the SKILL.md contains curl examples for listing shows, uploading audio, creating and publishing episodes, and checking analytics — all consistent with the stated purpose. However, the skill's source is unknown and no homepage or provenance is provided, which reduces trustworthiness.
- Instruction Scope
- noteInstructions are generally scoped to calling the Transistor.fm API and uploading audio; they don't ask to read unrelated system files. Issues: the doc references a local file 'references/api.md' that is not present in the bundle, and examples use undefined variables ($BASE, $KEY, $UPLOAD_URL, $AUDIO_URL) which are ambiguous. The guidance to 'retrieve from a secrets manager' is vague and could lead an agent to attempt accessing a secrets service if not constrained.
- Install Mechanism
- okNo install spec and no code files (instruction-only) — low installation risk because nothing is written to disk by an installer. The regex scanner had no code to analyze.
- Credentials
- concernThe SKILL.md explicitly requires a Transistor.fm API key (suggesting env var TRANSISTOR_API_KEY or retrieving from a secrets manager), but the registry metadata lists no required environment variables or primary credential. This mismatch is problematic: the skill needs a secret to function but does not declare it, and its vague suggestion to use a secrets manager could cause an agent to attempt broad secret-access actions unless you restrict that capability.
- Persistence & Privilege
- okSkill is not always-included and doesn't request elevated or persistent privileges. Model invocation is allowed (normal). There is no instruction to modify other skills or system-wide settings.