Ultimate Flashcards / Podcasts Tutor
v1.0.0Manage, create, and study flashcards, generate AI-based cards and podcasts, and track progress using EchoDecks API integration.
⭐ 1· 1.5k·0 current·0 all-time
by@drgeld
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Suspicious
high confidencePurpose & Capability
The skill clearly intends to integrate with EchoDecks (flashcards, AI generation, podcast synthesis). The included Python client talks to https://echodecks.com and implements the documented endpoints, so functionality matches the intended purpose. However, the registry metadata lists no required environment variables while the SKILL.md and code require ECHODECKS_API_KEY — this mismatch is unexpected and should be corrected.
Instruction Scope
SKILL.md and the CLI client both limit behavior to calling the EchoDecks external API (user, decks, cards, generate, podcasts, study). There are no instructions to read arbitrary local files, other environment variables, or to transmit data to endpoints other than echodecks.com. The cost of operations (10 and 50 credits) is documented in SKILL.md.
Install Mechanism
There is no install spec (instruction-only), and no network downloads or extraction steps in the bundle. A single Python client file is included; no installer that would write arbitrary code to disk at install time is present. This is lower risk from an install-mechanism perspective.
Credentials
The skill requires a single API key (ECHODECKS_API_KEY) according to SKILL.md and the client code, which is appropriate for a third-party API integration. However, the registry metadata does not declare this required environment variable (it lists none). That mismatch is a red flag: the skill will fail or will request the secret at runtime without the registry declaring it. Also note that the API key grants access to user data and can consume account credits (10 credits per card-generation, 50 per podcast), so providing the key has financial and privacy implications.
Persistence & Privilege
The skill is not marked always:true and does not request elevated or persistent system configuration. It does not modify other skills' configs. Autonomous invocation is allowed (platform default), which increases potential impact if the API key is compromised, but that is normal behavior and not by itself a reason to reject the skill.
What to consider before installing
This skill appears to do what it says (talk to EchoDecks to manage decks, generate cards, and synthesize podcasts), but there is a clear inconsistency: the SKILL.md and the included Python client require ECHODECKS_API_KEY, while the registry metadata declares no required environment variables. Before installing: 1) Verify the skill's origin and owner (there's no homepage provided in the package). 2) Confirm you trust echodecks.com and the publisher; check an official EchoDecks developer page for matching API behavior. 3) If you proceed, create or use a scoped API key with the minimal permissions possible and monitor credit usage — card and podcast generation consume account credits (10 / 50). 4) Ask the publisher to update the registry metadata to declare ECHODECKS_API_KEY so automated permission prompts are accurate. 5) If you do not trust the source or cannot verify the key's scope, do not provide your production EchoDecks API key; consider creating a test account/key first.Like a lobster shell, security has layers — review code before you run it.
latestvk97321znhcaqt195wj8k3nd6ph80k2md
License
MIT-0
Free to use, modify, and redistribute. No attribution required.