Podcasts
PassAudited by VirusTotal on May 12, 2026.
Overview
Type: OpenClaw Skill Name: podcasts Version: 1.0.0 The skill is classified as suspicious due to the explicit mention of executing external command-line tools like `yt-dlp` and Whisper for transcription in `briefings.md`. While these tools are legitimate, their execution by an AI agent implies shell access or a mechanism to run external programs. This capability introduces a significant remote code execution (RCE) vulnerability if inputs (e.g., URLs for `yt-dlp`) are not rigorously sanitized, potentially allowing shell injection. There is no evidence of malicious intent, but this represents a critical security flaw.
Findings (0)
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
Podcast URLs, audio, captions, or transcript queries may be fetched or processed by tools or outside services when generating summaries.
The skill may direct the agent to use local transcript tools or external podcast services to obtain source material for summaries. This is central to the stated purpose, but it is still tool and service use the user should recognize.
Sources for Transcripts ... YouTube auto-captions (via yt-dlp) ... Whisper transcription if audio available ... Third-party services (Taddy, Podcast Index)
Use trusted transcript sources, confirm before processing private audio, and be aware when third-party services are used.
Your podcast interests, VIP guest watchlist, and learning notes may persist locally and shape later recommendations or summaries.
The skill intentionally creates persistent local records of subscriptions, listening progress, extracted insights, and guest watchlists that may be reused in future podcast recommendations or briefings.
Store podcast data in `~/podcasts/` ... subscriptions.md ... queue.md ... knowledge.md ... guests.md
Review the `~/podcasts/` files periodically, avoid storing sensitive personal information there, and delete or edit entries you do not want reused.