Ultimate Flashcards / Podcasts Tutor

PassAudited by ClawScan on May 1, 2026.

Overview

The skill does what it advertises—connects to EchoDecks for flashcards and podcasts—but users should notice that it needs an API key, can change their EchoDecks data, and can spend EchoDecks credits.

This appears purpose-aligned and not malicious. Before installing, be comfortable giving it an EchoDecks API key and letting it read or update your EchoDecks account. Pay special attention before generating cards or podcasts because those actions spend credits, and avoid submitting private source text unless you trust EchoDecks with it.

Findings (3)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Note

ASI03: Identity and Privilege Abuse

What this means

Anyone installing the skill must provide an EchoDecks API key, which allows the skill to read account information and perform supported account actions.

Why it was flagged

The client sends the ECHODECKS_API_KEY as an authentication header to the EchoDecks API, granting the skill access to the user’s EchoDecks account.

Skill content

"X-API-KEY": get_api_key()

Recommendation

Use an API key you are comfortable granting to this integration, revoke or rotate it when no longer needed, and consider limiting its scope if EchoDecks supports scoped keys.

Note

ASI02: Tool Misuse and Exploitation

What this means

If used, the skill can spend EchoDecks credits, create generated content, and alter spaced-repetition progress.

Why it was flagged

The tool set includes actions that consume credits and update study state. These actions are disclosed and purpose-aligned, but they have account impact.

Skill content

echodecks_generate_cards ... *Cost: 10 credits.* ... echodecks_generate_podcast ... *Cost: 50 credits.* ... echodecks_submit_review ... Submit a spaced-repetition review for a card.

Recommendation

Confirm credit-spending generation and review-submission actions before running them, and verify deck/card IDs.

Note

ASI07: Insecure Inter-Agent Communication

What this means

Text supplied for flashcard generation and account/deck identifiers are transmitted to EchoDecks.

Why it was flagged

The skill sends API requests, including user-provided topics or source text for card generation, to the external EchoDecks service.

Skill content

BASE_URL = "https://echodecks.com/api/apps/68bc0769be6e58e1c8385b2b/functions/externalApi"

Recommendation

Avoid sending sensitive private material unless you trust EchoDecks’ handling of that data.