Ultimate Flashcards / Podcasts Tutor
v1.0.0Manage flashcards, generate AI-based cards, create audio podcasts, and track study progress using EchoDecks API integration.
⭐ 1· 1.4k·0 current·0 all-time
by@drgeld
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Suspicious
medium confidencePurpose & Capability
The included README, API_DOCS, SKILL.md, and scripts/echodecks_client.py consistently implement an EchoDecks flashcards/podcast integration. However the registry metadata lacks a description and does not declare the ECHODECKS_API_KEY that the skill clearly requires, which is an incoherence between stated registry metadata and actual capability.
Instruction Scope
SKILL.md instructions and the CLI wrapper are narrowly scoped to EchoDecks API operations (user, decks, cards, generate, podcasts, study). The runtime script only reads ECHODECKS_API_KEY and communicates with echodecks.com; it does not attempt to read other system files or unrelated environment variables.
Install Mechanism
There is no install spec (instruction-only), which limits on-disk installation risk. However the skill includes a Python CLI that requires a Python runtime and the 'requests' library; those dependencies are not declared in the metadata — this mismatch can cause runtime failure or obscure hidden setup requirements.
Credentials
The script requires a sensitive API key (ECHODECKS_API_KEY) to operate, but the registry metadata lists no required env vars or a primary credential. That omission is important: you must supply an API key that likely grants account access and can incur credit usage (e.g., 10 credits per card generation, 50 for podcasts). The requested secret is proportionate to the function, but it is not declared where it should be in the registry.
Persistence & Privilege
The skill does not request always: true and does not attempt to modify other skills or system settings. It operates as a standard, on-demand integration that will make outbound API calls to echodecks.com.
What to consider before installing
What to check before installing:
- Confirm the skill owner and homepage (registry metadata has no description/homepage). Prefer skills with verifiable sources.
- The skill needs an API key (ECHODECKS_API_KEY). Only provide a key you trust; consider using a least-privilege or test account because API calls can consume credits and access your account.
- Ensure your agent environment has Python 3 and the 'requests' library available (these are required by scripts/echodecks_client.py but are not declared in metadata).
- Verify the endpoint domain (echodecks.com / echodecks.app) is legitimate for the service you expect. The script contacts a hard-coded BASE_URL on echodecks.com.
- Ask the publisher to update registry metadata to declare required env vars and runtime dependencies and to include a homepage so you can verify the project.
- If you proceed, monitor network activity and review an API key's permissions/usage to detect unexpected requests or credit consumption.Like a lobster shell, security has layers — review code before you run it.
latestvk97aaab6dpt5sb1xkv9rjmpesx80kh7a
License
MIT-0
Free to use, modify, and redistribute. No attribution required.