Security audit
Security checks for vulnerabilities and agentic risk
This skill coherently delegates podcast generation to OnePress and discloses the API key and remote processing model, with user cautions needed for sensitive uploads and voice cloning consent.
Install only if you are comfortable sending podcast prompts and any source documents to OnePress. Use cloned voices only with the voice owner's authorization, and avoid uploading confidential, regulated, or personal material unless OnePress's terms and your own obligations allow it.
The description advertises cloned voices without any warning about consent, impersonation, or privacy risks. Voice cloning can enable unauthorized replication of a person's voice, creating legal, ethical, and social-engineering risks if users are not clearly told to use only voices they own or are authorized to use.
The skill explicitly instructs the agent to submit user-provided topics, documents, or slide decks to OnePress, but it does not clearly warn users that their prompts and source materials are transmitted to a third-party service for processing. This creates a meaningful privacy and data-handling risk, especially when users may provide sensitive business or personal content under the assumption the agent is operating locally.
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
## Notes
- Be honest: audio is produced on getonepress.com, not here. Never fabricate files or links.
- Never ask the user to paste their API key into chat — env/config only.
No suspicious patterns detected.