PodcastIndex
PassAudited by ClawScan on May 1, 2026.
Overview
This skill appears to do what it says—search Podcast Index with authenticated, read-only requests—though its credential requirement is disclosed in SKILL.md but not in registry metadata.
Before installing, be aware that the skill needs Podcast Index API credentials and will send podcast-related queries to api.podcastindex.org. This behavior is consistent with the stated purpose, but the registry metadata should ideally declare the required environment variables so credential use is clear before installation.
Findings (2)
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
Podcast search terms and request metadata may be sent to the Podcast Index API when the skill is used.
The skill instructs the agent to make external authenticated HTTP requests. This is expected for a Podcast Index search integration and the listed endpoints are GET-based, but users should know queries are sent to the provider.
Use the built-in HTTP request tool (e.g., fetch or http_get) to send GET requests with these headers.
Use the skill for podcast-related searches only, and avoid sending sensitive private text as search queries unless you are comfortable sharing it with Podcast Index.
The agent may use your Podcast Index API credentials to authenticate requests made on your behalf.
The skill requires an API key and secret and later instructs use of authentication headers. This is appropriate for the stated API, but the registry metadata lists no required env vars or primary credential, so the credential requirement is under-declared outside SKILL.md.
Ensure PODCASTINDEX_API_KEY and PODCASTINDEX_API_SECRET are set in the environment or config.
Provide only Podcast Index credentials intended for this use, keep them scoped to that service, and consider updating metadata so the credential requirement is visible before install.