ClawHub
Back to skill

Security audit

podcast-producer

Security checks for vulnerabilities and agentic risk

Overview

This is a markdown-only podcast production guide with purpose-aligned guest, recording, analytics, and distribution guidance, with no executable or hidden behavior found.

This skill appears safe to install as a podcast workflow aid. When using it for guest research, recordings, transcripts, quotes, or audience analytics, make sure you have appropriate consent, avoid collecting unnecessary personal details, and review any public-facing assets before posting.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (3)

Context Leakage

High
Category
Data Exfiltration
Confidence
75% confidence
Finding

Code or instructions that leak agent conversation context to external services, potentially exposing sensitive user interactions.

Content

Scanner excerpt · SKILL.md (reported line 138)May include surrounding context.

md
1. **Guest Research**: Deep dive on guest background
2. **Question Prep**: Develop question bank
3. **Pre-Interview**: Brief guest on format
4. **Record**: Capture conversation
5. **Edit**: Remove filler, enhance audio
6. **Review**: Get guest approval if needed
7. **Create Assets**: Pull quotes and clips

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The manifest description says 'Use when: podcast production pipeline, episode scripting, guest management, audio production, show notes generation' but does not define specific invocation phrases, scope boundaries, or exclusion conditions. For a markdown/manifest file, this is an ambiguous activation description that could overlap with a wide range of ordinary content-creation requests.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
84% confidence
Finding

The skill explicitly covers guest research, audience analytics, and interview workflows but provides no privacy guidance, consent requirements, or handling limits for personal and audience data. In practice, this can lead an agent or operator to over-collect, retain, or repurpose sensitive personal information without adequate notice or safeguards.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.