Cast

PassAudited by ClawScan on May 1, 2026.

Overview

This is a coherent Typecast text-to-speech wrapper, with the main things to notice being the external CLI install, Typecast API key use, and possible handling of your text by the provider.

Before installing, verify that you trust the `neosapience/tap/cast` Homebrew package, provide a Typecast API key only if you are comfortable with the integration, and avoid sending sensitive text unless the provider's data practices fit your needs.

Findings (3)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Low

#ASI04: Agentic Supply Chain Vulnerabilities

What this means

Installing the skill means trusting the external `cast` binary to run locally and handle TTS requests.

Why it was flagged

The skill depends on an external Homebrew-installed CLI that is not included in the artifact set. This is central to the TTS purpose, but users should verify the tap and package before installation.

Skill content

brew | formula: neosapience/tap/cast | creates binaries: cast

Recommendation

Install only if you trust the Homebrew tap and Typecast CLI source; review the package provenance where possible.

Low

#ASI03: Identity and Privilege Abuse

What this means

Anyone or anything able to read the saved config or environment may be able to use the Typecast account tied to the API key.

Why it was flagged

The skill requires and can locally save a Typecast API key. This is expected for an authenticated Typecast integration, but the credential is sensitive.

Skill content

cast login <api_key>         # save API key
Config file: `~/.typecast/config.yaml`
`TYPECAST_API_KEY` | `--api-key`

Recommendation

Use a dedicated Typecast API key if possible, protect the local config file, and run `cast logout` or remove the key when no longer needed.

Low

#ASI07: Insecure Inter-Agent Communication

What this means

Text passed to the TTS command, including copied file contents, may be processed by the Typecast service under the configured account.

Why it was flagged

The skill is an authenticated Typecast TTS CLI workflow and examples include sending local file text into the CLI. This is purpose-aligned, but it represents a provider data boundary users should notice.

Skill content

description: Multilingual TTS via Typecast CLI with emotion control
cast "$(cat script.txt)"

Recommendation

Avoid passing confidential or regulated text unless Typecast's handling, retention, and privacy terms are acceptable for that data.