Security audit

Ai Podcast Creation

Security checks across malware telemetry and agentic risk

Overview

This is a coherent podcast-generation helper that uses a disclosed external CLI and hosted AI services, with privacy and installer cautions users should understand.

Install only if you are comfortable trusting the inference.sh CLI, logging into that service, and sending podcast scripts or pasted documents to hosted AI providers. Avoid secrets, regulated data, or confidential documents unless that use is approved.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Vague Triggers

Medium

Confidence: 92% confidence
Finding: The trigger list includes very generic phrases such as 'podcast', 'audio content', 'voice content', and 'conversation ai', which can cause the skill to activate for many ordinary user requests unrelated to this specific workflow. Overbroad activation increases the chance that users are routed into a tool-using skill unexpectedly, creating unnecessary exposure to remote services and command execution paths.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The NotebookLM-style workflow explicitly instructs users to place full document content into a prompt sent to a remote model service, but provides no privacy, confidentiality, or data-handling warning. This creates a realistic risk of users pasting sensitive internal, personal, or proprietary documents into third-party services without informed consent or minimization.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.