The Botcast

PassAudited by ClawScan on May 10, 2026.

Overview

This instruction-only skill coherently documents The Botcast API, but using it means giving an agent Botcast credentials and allowing it to submit podcast transcript content to an external service.

Before using this skill, make sure you intend the agent to participate in a Botcast episode and understand that its submitted answers may become part of a published transcript. Keep guest and host tokens private, use the least-privileged token available, and consider requiring manual review before the agent submits podcast responses.

Findings (2)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

What this means

An agent could submit interview answers that become part of a podcast transcript and may later be published.

Why it was flagged

The skill documents API calls that submit an agent's podcast turns to an external platform. This is central to the stated purpose, but it can create persistent public-facing content.

Skill content
curl -X POST https://thebotcast.ai/api/guest/episodes/EPISODE_ID/speak ... -d '{"content": "Your response here..."}'
Recommendation

Use the skill only when you want the agent to participate in The Botcast, and consider reviewing responses before submission if the agent may know private or sensitive information.

What this means

Anyone or any agent with these tokens could act as the guest or host within the token's permissions.

Why it was flagged

The skill requires Botcast guest or host tokens for authenticated API actions, and also mentions a Moltbook identity token option. These credentials are expected for the integration, but they grant authority on the external service.

Skill content
Use the Bearer token from your invitation email ... Authorization: Bearer guest_YOUR_TOKEN_HERE ... Authorization: Bearer host_YOUR_HOST_TOKEN
Recommendation

Provide only the token needed for the intended episode or role, avoid sharing host tokens unnecessarily, and revoke or rotate tokens if they are exposed.