Article to Podcast

• Outcome: Review
• Latest audit: Jul 19, 2026 · 10:35 AM UTC
• Version: 1.0.0

Overview

The skill mostly matches its podcast-generation purpose, but it includes sensitive browser/proxy credential handling and cloud publishing workflows that users should review before installing.

Install only if you are comfortable with the agent publishing podcast assets to your TOS bucket and sending episode text to Doubao/ByteDance for TTS. Avoid using the Chrome proxy-credential recipe unless you fully understand the credential exposure risk, and do not process private or access-controlled source material without explicit confirmation and cleanup.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (5)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 93% confidence
• Finding: The skill clearly instructs the agent to use environment variables, read and write local files, access the network, and execute shell commands, yet it declares no permissions. This creates a transparency and control gap: a host may invoke the skill without realizing it can publish content, upload files, and use sensitive credentials, increasing the chance of over-privileged or unsandboxed execution.

Context-Inappropriate Capability

Medium

• Confidence: 94% confidence
• Finding: The guide explicitly instructs operators to recover authenticated SOCKS5 proxy credentials from Chrome process arguments and reuse them in curl commands. This exposes secrets via process listings, encourages credential handling outside approved secret-management paths, and can lead to credential leakage, unauthorized network access, or misuse of privileged proxy infrastructure.

Missing User Warnings

Medium

• Confidence: 81% confidence
• Finding: The workflow instructs operators to fetch remote content through an authenticated browser session and write the resulting bytes directly to local files, but it provides no guardrails around trusted origins, file size limits, content validation, or session-scope risks. In this skill context, that makes it easier to exfiltrate or persist third-party content obtained with ambient browser authentication and can unintentionally pull sensitive or unauthorized data into local storage and onward to TOS.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The instructions normalize handling raw proxy credentials and authenticated outbound requests without any warning about secret exposure, logging, shell history, or transmission risks. In a content-ingestion skill, this is more dangerous because operators may routinely fetch third-party content, increasing the chance that secrets are reused broadly or disclosed during troubleshooting.

Missing User Warnings

Medium

• Confidence: 84% confidence
• Finding: The code sends full text content, speaker selection, and narration context to an external ByteDance TTS API, but this file contains no explicit user-consent, redaction, or sensitivity checks before exfiltrating content off-box. In a podcast-generation skill, source material may include unpublished drafts, private notes, or sensitive data, so silent transfer to a third-party service creates a real privacy and data-governance risk.

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

No suspicious patterns detected.