T09 · Insecure Skill Coding Practices
Error
- Location
SKILL.md:524- Finding
Podcast Outputs Are Publicly and Permanently Published by Default
- Content
View full analysis
` share page out of the box, now with an **immersive synced-transcript player** (the script highlights sentence-by-sentence in time with playback). Use `--private` or `--no-publish` to change that. To flip an **existing** episode's visibility later, use [`pixcli publish`](#pixcli-publish-id--change-share-visibility). ``` From `SKILL.md:599-604`: ```markdown (Nano Banana 2, so the title + date render as real text), published **public and permanent**. Prefer the `podcast` link set from the result (`audio_url`, `cover_url`, `transcript_url`) — those carry the correct file extension. The job id stem is also stable if you must rebuild a URL: - audio (when published): `…/p/pod-.mp3` - cover (always public): `…/p/pod--cover` (extension is usually `.jpg`; ``` From `references/command-reference.md:250-261`: ```markdown | `--private` / `--no-publish` | flag | — | Podcasts publish **public + permanent by default**; `--private` requires your key, `--no-publish` skips publishing | | `--json` | flag | `false` | Machine-readable JSON output | **Notes** - Gemini multi-speaker TTS caps at **2 voices** per episode — pick 2 presets/voices. - **Music** is loud only for the first ~4s and last ~5s; under speech it stays faint (`bed_gain` ~0.06). Beds come from a permanent library — list them with `GET /api/v1/audio/podcast/presets`. Custom beds must be WAV (the in-worker mixer reads PCM directly). - **Expression tags are always English** (`[enthusiastic]`, `[laughing]`, `[agreement]`, `[amazement]`, …) even when the dialogue is in another language; t ...[truncated 2898 chars]- Remediation
View remediation