Podcast Generator
v1.1.0Convert articles, blog posts, or any text into professional podcast scripts and TTS audio. Use when a user wants to: (1) Transform written content into conve...
⭐ 1· 405·2 current·2 all-time
by@elevo11
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Suspicious
medium confidencePurpose & Capability
Name/description match the included code: generate_script.py creates podcast scripts and generate_audio.py produces TTS audio; billing.py calls a SkillPay.me billing API which fits the declared per-call charge. However, the registry metadata lists 'Required env vars: none' while SKILL.md and scripts require SKILLPAY_API_KEY — this mismatch is an incoherence that should be resolved.
Instruction Scope
SKILL.md gives explicit, narrow runtime steps (billing check → generate script → generate audio → view stats). The scripts perform expected actions: call the SkillPay API, parse/generate text, invoke edge-tts and optionally ffmpeg, and read/write a local stats file. The instructions and scripts do reference filesystem paths (/tmp for temp audio, and ~/.openclaw/workspace/.../data/stats.json) and make outbound HTTP calls to skillpay.me; they do not attempt to read unrelated system files or extraneous environment variables.
Install Mechanism
No install spec or remote downloads are present; the package is instruction + local scripts only. The only external dependencies are expected libraries/binaries (edge-tts, ffmpeg) which are invoked if present — no arbitrary remote code is fetched or executed by an installer.
Credentials
SKILL.md and scripts require SKILLPAY_API_KEY to contact the billing endpoint, which is proportionate to a paid per-call workflow. However, registry metadata claiming 'no required env vars' is inconsistent with the code and documentation. That mismatch is a red flag — the skill will not work correctly without the API key and the omission could cause a user to expose a key without realizing why it's needed. Also note the script will receive whatever API key you provide and will send it to skillpay.me.
Persistence & Privilege
The skill does not request elevated platform privileges or 'always: true'. It does persist usage data to a local file under the user's home (~/.openclaw/workspace/podcast-generator/data/stats.json) and creates that directory. This is reasonable for usage stats, but users should be aware titles and metadata are stored locally and the skill writes/creates files in their home directory and /tmp.
What to consider before installing
This skill appears to implement the advertised podcast script + TTS workflow and a per-call billing flow via SkillPay.me, but there are some inconsistencies you should address before installation: (1) The registry metadata lists no required environment variables, but SKILL.md and billing.py require SKILLPAY_API_KEY — confirm why the metadata omitted this and only provide an API key you trust and can revoke. (2) The billing script will send your provided API key to https://skillpay.me; verify that domain and the service are legitimate and that the API key scope/permissions are appropriate. (3) The audio generator invokes system binaries (edge-tts, ffmpeg) and writes temporary files to /tmp and persistent stats to ~/.openclaw/workspace/…; run the skill in a sandbox or isolated environment first if you are concerned about file writes. (4) If you want to proceed, consider using a limited/revocable SkillPay test key, inspect or run the scripts locally to verify behavior, and avoid providing high-privilege credentials. If the owner/publish metadata is unknown, exercise extra caution.Like a lobster shell, security has layers — review code before you run it.
latestvk9738myx4k66qb6w5zm0ayd38s82c8rn
License
MIT-0
Free to use, modify, and redistribute. No attribution required.