ClawHub
Back to skill

Security audit

Podcastfy Openclaw Skill

Security checks for vulnerabilities and agentic risk

Overview

The skill is coherent documentation for using Podcastfy, with expected but important privacy and supply-chain considerations around cloud APIs and package installation.

Install in a virtual environment, consider pinning Podcastfy to a reviewed version, and avoid processing sensitive patient, medical, dental, confidential, or regulated documents with cloud providers unless you have consent and compliance approval. Use the local or transcript-only options where appropriate, and only grant sudo for the FFmpeg package install if you trust the system package source.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:13
Finding

Unpinned Third-Party Package Installation

Content
View full analysis
Remediation
View remediation
" ``` 2. Generate and maintain a dependency lockfile that also constrains transitive dependencies. 3. Record cryptographic hashes for all resolved distributions and install with hash enforcement, such as: ```bash python -m pip install --require-hashes -r requirements.txt ``` 4. Download packages only from an explicitly approved package index over HTTPS, and avoid untrusted extra indexes. 5. Review package provenance, release signatures or attestations where available, maintainer changes, and dependency updates before changing the pinned version. 6. Install and run the package in an isolated virtual environment or container under a non-privileged account. 7. Provide only the API credentials required for the selected providers and avoid exposing unrelated secrets to the process. 8. Add automated dependency vulnerability and integrity scanning to the update workflow. ]]>

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (3)

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
70% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 26)May include surrounding context.

brew install ffmpeg

Ubuntu/Debian

sudo apt install ffmpeg

text

### 3. Configure API Keys

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
70% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 210)May include surrounding context.

brew install ffmpeg

Ubuntu/Debian

sudo apt install ffmpeg

text

### 3. Configure API Keys

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The skill instructs users to configure cloud API keys and use default OpenAI/Gemini/ElevenLabs-backed generation, but it does not clearly warn that provided text, URLs, PDFs, images, and derived content may be transmitted to third-party services for processing. In an agent setting, users may supply sensitive medical, dental, or internal documents, creating a meaningful privacy and compliance risk if data is sent off-box without explicit disclosure.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.