Ultimate Flashcards / Podcasts Tutor

PassAudited by VirusTotal on May 12, 2026.

Overview

Type: OpenClaw Skill Name: Developer: Version: Description: OpenClaw Agent Skill Suspicious High-Entropy/Eval files: 1 The skill is benign. It provides a Python CLI client (`scripts/echodecks_client.py`) to interact with the EchoDecks API, as described in `SKILL.md` and `README.md`. It securely retrieves the `ECHODECKS_API_KEY` from environment variables and directs all network requests to the legitimate `https://echodecks.com` domain. There is no evidence of data exfiltration, malicious execution, persistence mechanisms, prompt injection attempts against the agent, or obfuscation. All actions are clearly aligned with the stated purpose of flashcard management and AI generation.

Findings (0)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Note

ASI03: Identity and Privilege Abuse

What this means

Anyone installing the skill must provide an EchoDecks API key, which allows the skill to read account information and perform supported account actions.

Why it was flagged

The client sends the ECHODECKS_API_KEY as an authentication header to the EchoDecks API, granting the skill access to the user’s EchoDecks account.

Skill content

"X-API-KEY": get_api_key()

Recommendation

Use an API key you are comfortable granting to this integration, revoke or rotate it when no longer needed, and consider limiting its scope if EchoDecks supports scoped keys.

Note

ASI02: Tool Misuse and Exploitation

What this means

If used, the skill can spend EchoDecks credits, create generated content, and alter spaced-repetition progress.

Why it was flagged

The tool set includes actions that consume credits and update study state. These actions are disclosed and purpose-aligned, but they have account impact.

Skill content

echodecks_generate_cards ... *Cost: 10 credits.* ... echodecks_generate_podcast ... *Cost: 50 credits.* ... echodecks_submit_review ... Submit a spaced-repetition review for a card.

Recommendation

Confirm credit-spending generation and review-submission actions before running them, and verify deck/card IDs.

Note

ASI07: Insecure Inter-Agent Communication

What this means

Text supplied for flashcard generation and account/deck identifiers are transmitted to EchoDecks.

Why it was flagged

The skill sends API requests, including user-provided topics or source text for card generation, to the external EchoDecks service.

Skill content

BASE_URL = "https://echodecks.com/api/apps/68bc0769be6e58e1c8385b2b/functions/externalApi"

Recommendation

Avoid sending sensitive private material unless you trust EchoDecks’ handling of that data.