Ultimate Flashcards / Podcasts Tutor
PassAudited by ClawScan on May 1, 2026.
Overview
The skill is a coherent EchoDecks integration, but users should notice that it uses an API key and can spend EchoDecks credits or modify study data.
This appears safe to install if you trust EchoDecks and intend to connect your account. Before using it, understand that the API key enables account access, generated cards and podcasts may consume credits, and submitted reviews can change your study progress.
Findings (3)
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
If installed and configured, the agent can use the provided EchoDecks API key to read account information and perform supported account actions.
The client authenticates requests with an EchoDecks API key from the ECHODECKS_API_KEY environment variable, giving the skill access to the user's EchoDecks account.
"X-API-KEY": get_api_key()
Use a revocable EchoDecks API key, avoid sharing it, and remove or rotate it if you no longer want the agent to access the account.
Using generation tools may consume EchoDecks credits and create new cards or podcasts in the account.
The skill exposes purpose-aligned API actions that spend EchoDecks credits and generate account content. The costs are disclosed.
echodecks_generate_cards ... *Cost: 10 credits.* ... echodecks_generate_podcast ... *Cost: 50 credits.*
Only ask the agent to run generation actions when you intend to spend credits, and review the target deck IDs before proceeding.
The install metadata may not warn users up front that a credential is needed for the skill to work.
The registry metadata does not declare the API key requirement even though SKILL.md and README.md state that ECHODECKS_API_KEY is required.
Required env vars: none; Env var declarations: none; Primary credential: none
Treat ECHODECKS_API_KEY as a required credential despite the registry metadata, and prefer metadata updates that declare it explicitly.