ClawHub
Back to skill

Security audit

Podcast Summarize

Security checks across malware telemetry and agentic risk

Overview

This podcast summarization skill is coherent and purpose-aligned, with only expected privacy considerations around optional cloud transcription and media downloads.

Install this if you want podcast summarization and are comfortable providing podcast audio or links for processing. Prefer local Whisper for private recordings, review any URL before downloading media, protect any OPENAI_API_KEY you configure, and use a virtual environment for the suggested Python packages.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

Missing User Warnings

Medium
Confidence
90% confidence
Finding
The script explicitly recommends sending the provided audio file to an external OpenAI transcription API but gives no privacy notice, consent prompt, or warning that local audio content may leave the user's environment. In a podcast summarization skill, audio may contain unpublished, licensed, or sensitive material, so normalizing external upload without disclosure creates a real data-handling risk.

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal