Skill flagged — suspicious patterns detected
ClawHub Security flagged this skill as suspicious. Review the scan results before using.
Podwise
v0.2.0Podcast knowledge workflows powered by Podwise CLI: search podcasts and episodes by keyword, monitor followed shows for new releases, find popular episodes,...
⭐ 0· 140·1 current·1 all-time
by@saitowu
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Benign
high confidencePurpose & Capability
The name/description (podcast search, processing, summaries, exports) matches the instructions: every workflow uses the Podwise CLI and references only podcast/audio inputs, local files, or Podwise/YouTube/Xiaoyuzhou URLs. No unrelated credentials, binaries, or system-level accesses are required.
Instruction Scope
Workflows instruct the agent to read a local taste.md (personal preferences) and to write notes/export files to the current working directory; they also instruct checking podwise config and running podwise commands. Reading taste.md and 'silently recording' internal notes are within the skill's personalization goal but reduce transparency — the agent will access local files and keep ephemeral notes unless the user requests saving them explicitly.
Install Mechanism
The skill is instruction-only (no automatic installer), which is low-risk, but the included installation doc recommends a curl | sh install script from raw.githubusercontent.com (https://raw.githubusercontent.com/hardhackerlabs/podwise-cli/main/install.sh) and a Homebrew tap (hardhackerlabs/podwise-tap). Those are standard but are higher-risk install patterns (download-and-exec, unknown tap). The doc also points to GitHub Releases and source builds (safer).
Credentials
The skill declares no required environment variables or credentials. It does reference the CLI config path (~/.config/podwise/config.toml) and the CLI's API key configuration, which is proportionate to a CLI-based tool that needs an API key. There are no unrelated credential requests.
Persistence & Privilege
The skill does not request always:true and is user-invokable only. It writes files to the current working directory when the workflows explicitly ask to save notes, cards, or summaries (user-visible behavior). There is no indication it modifies other skills or system-wide settings.
Assessment
What this means and what to check before installing/use:
- This is an instruction-only skill that drives the Podwise CLI. It does not bundle or execute code itself; instead it runs podwise commands and reads/writes files in the current working directory. That behavior aligns with the described podcast workflows.
- Installation: the included installation doc suggests several install options. The automatic curl | sh installer (raw.githubusercontent.com/hardhackerlabs/...) and an untrusted Homebrew tap are the riskiest suggestions — do NOT run curl | sh without reviewing the script first. Prefer installing from a GitHub release archive you inspect, building from source, or using a package manager you trust.
- Local file access: the skill will read a local taste.md for personalization and will write note/export files to your current working directory (e.g., debate summaries, episode notes, Anki/CSV exports). If taste.md may contain sensitive data, review or remove sensitive fields before using the skill.
- Config and API keys: Podwise CLI stores config in ~/.config/podwise/config.toml and requires an API key or browser auth. Confirm any API keys are from podwise.ai and that you trust that service. Exports to third-party services (Notion, Readwise) will use whatever credentials the Podwise CLI or its auth flow provides — verify and control those integrations in the CLI before exporting.
- Quota/processing: running podwise process consumes Podwise credits. The workflows explicitly require confirming before processing; the agent should ask you before using quota. Always confirm before allowing processing of remote content or local files.
- Transparency: some workflow steps say to 'read' taste.md silently and to 'silently record' internal notes used for a later saved summary. This is not exfiltration, but it means the agent will access and temporarily store some internal state. If you want full transparency, ask the agent to show any notes it recorded before saving them to disk or exporting.
If you decide to proceed: (1) review the install script before running it, (2) inspect ~/.config/podwise/config.toml and any connected integrations, (3) ensure taste.md contains only the non-sensitive preferences you want the agent to use, and (4) be prepared to confirm any processing that consumes credits or exports data externally.Like a lobster shell, security has layers — review code before you run it.
audiovk97ag1xch3p0079xdd9x0f7rt5846dvhlanguage-learningvk97ag1xch3p0079xdd9x0f7rt5846dvhlatestvk97ag1xch3p0079xdd9x0f7rt5846dvhmindmapvk97ag1xch3p0079xdd9x0f7rt5846dvhnotionvk97ag1xch3p0079xdd9x0f7rt5846dvhobsidianvk97ag1xch3p0079xdd9x0f7rt5846dvhpkmvk97ag1xch3p0079xdd9x0f7rt5846dvhpodcastvk97ag1xch3p0079xdd9x0f7rt5846dvhpodwisevk97ag1xch3p0079xdd9x0f7rt5846dvhspotifyvk97ag1xch3p0079xdd9x0f7rt5846dvhsummaryvk97ag1xch3p0079xdd9x0f7rt5846dvhtranscriptvk97ag1xch3p0079xdd9x0f7rt5846dvhxiaoyuzhouvk97ag1xch3p0079xdd9x0f7rt5846dvhyoutubevk97ag1xch3p0079xdd9x0f7rt5846dvh
License
MIT-0
Free to use, modify, and redistribute. No attribution required.
Runtime requirements
🎧 Clawdis
