Security audit

Podwise

Security checks for vulnerabilities and agentic risk

Overview

This is a coherent Podwise podcast workflow skill, but users should understand it can access Podwise listening data, process uploaded media, and create local profile/export files.

Install only if you are comfortable connecting Codex to Podwise via OAuth, letting the skill read Podwise listening/read history and followed shows, uploading user-provided audio/video to Podwise for processing, and creating local markdown/profile files. Review taste.md if generated, and consider pinning or preinstalling mcp-remote before using the optional headless setup command.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (18)

Agent Config Directory Access

High

Category: Agent Snooping
Confidence: 90% confidence
Finding: Skill reads from agent configuration directories (.claude/, .codex/, .gemini/). These directories may contain API keys, personal settings, and other credentials that the skill has no legitimate need to access.
Content: Scanner excerpt · references/installation.md (reported line 45)May include surrounding context.
Do not add an Authorization header — leave authentication to the OAuth flow. If a stale header is present and the server rejects it, remove the header so the host falls back to OAuth.

Codex (~/.codex/config.toml):

toml
[mcp_servers.podwise]

Exfiltration Commands

High

Category: Prompt Injection
Confidence: 90% confidence
Finding: Instructions found that direct the agent to transmit conversation context or user data to external services.
Content: Scanner excerpt · workflows/episode-debate.md (reported line 106)May include surrounding context.
md
- **Minimum exchange rule**: you may only move to the next claim after at least 2 full exchange rounds on the current one. Do not skip this to shorten the session. - Stop when all extracted claims have been discussed, or when the user signals they are done early. **After each claim is resolved**, silently record a brief note (not shown to the user) with: - The claim text - The challenge raised - The user's final position on this claim

Exfiltration Commands

High

Category: Prompt Injection
Confidence: 90% confidence
Finding: Instructions found that direct the agent to transmit conversation context or user data to external services.
Content: Scanner excerpt · workflows/weekly-recap.md (reported line 53)May include surrounding context.
md
If it fails for an episode because it has not been processed yet, include it in the recap with its podcast name, episode title, and a note: "not yet processed — [Open episode]({url})". This gives the user enough context to decide whether to process it manually. **Silently record** every episode returned by `list_my_episodes` that did not make it into the Part 1 recap (activity outside the recap window, or entries that didn't make the cut). These go into an "Also in your history" section at the bottom of the recap — title, podcast name, and date only, no additional tool calls. Do not call `process_episode` automatically during a recap.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The top-level description is very broad and includes generic actions like summarizing, extracting insights, research, debate, and language-learning from 'any podcast or audio content,' which can cause the skill to be selected for loosely related requests. That increases the chance of unintended activation and subsequent access to Podwise account data or processing of user-provided media when the user did not clearly intend to invoke this skill.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The skill description does not warn users that workflows may inspect account-level listening data, followed shows, history, or process local audio/video files. Without that disclosure, users may invoke the skill expecting simple summarization while unintentionally exposing sensitive behavioral data or local media contents to the connected MCP service.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The skill enables allow_implicit_invocation without any documented trigger constraints or exclusions, which can cause the agent to invoke the external Podwise MCP service automatically based on broad user intent. Because this skill can process URLs, local media files, and transcript-related content through a remote service, unintended invocation could expose user data or send content to a third party without sufficiently explicit user intent.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 91% confidence
Finding: The installation guidance tells users to execute npx -y mcp-remote without pinning a specific package version. That causes retrieval and execution of whatever version is current on the registry at runtime, creating a supply-chain risk if the package is compromised or a breaking/malicious update is published. In setup documentation for an MCP bridge, this is a real security concern because the command is explicitly intended to be run by users.
Content: No source excerpt is available for this finding.

Autonomous Decision Making

Medium

Category: Excessive Agency
Confidence: 75% confidence
Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
Content: Scanner excerpt · references/mcp.md (reported line 278)May include surrounding context.
md
- **"Pro or Enterprise plan required"**: report it and relay the upgrade link. Do not retry or fabricate output. - **`ask_podwise` returns a quota error**: report it directly. Do not fabricate an answer. - **SRT export returns a download link**: long transcripts are not sent inline — share the link with the user (valid for 10 minutes). - **`process_episode` / `complete_audio_upload` run without confirmation**: always wrong — both consume quota. - **URL passed where a seq is expected**: extract the trailing integer from the URL first. - **`send_episode` / `send_clips` fail**: the Notion / Readwise integration is not connected in Podwise settings.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The workflow explicitly tells the agent to read a local taste.md profile 'silently', which bypasses user awareness and consent for accessing locally available personal preference data. Even though the file is used for personalization rather than exfiltration, it may contain sensitive behavioral information such as interests, subscriptions, and listening habits, so covert access creates a privacy and trust risk.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The workflow instructs the agent to persist a debate summary containing the user's positions and discussion content to the working directory, but it does not require an explicit privacy warning about retention or visibility to other tools/users with access to that directory. This creates a data persistence risk, especially if the debate includes sensitive beliefs, opinions, or personal context the user did not expect to be stored long-term.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The workflow instructs the agent to read a local taste.md file silently, without first notifying the user or obtaining consent. Even if the file is expected to contain only preferences, local files can include sensitive notes, paths, integration details, or other private metadata, so silent access creates a privacy and data-minimization risk.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The workflow allows sending episode-derived content to external services such as Notion or Readwise based on integration availability, but it does not require a clear disclosure that data will leave the current environment. This can cause unintentional sharing of potentially sensitive transcript summaries, highlights, or notes with third-party services.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: This workflow instructs the agent to collect and persist a personalized profile containing subscriptions, listening behavior, inferred interests, languages, and PKM tool usage into a local taste.md file, but it does not require explicit user consent or provide a privacy warning before doing so. Because the file is then reused automatically by multiple other skills, the data can persist longer than the user expects and broaden exposure of sensitive behavioral inferences beyond the immediate task.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The workflow instructs the agent to read a local taste.md file 'silently' and use its contents to influence behavior without clearly disclosing that local file access occurred at runtime. Even though the file is used for legitimate personalization, undisclosed local-context ingestion can surprise users, leak sensitive preferences or notes into outputs, and weakens informed consent around filesystem access.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Low

Category: Not specified by scanner
Confidence: 82% confidence
Finding: The manifest focuses on podcast search, processing, summarization, transcript/Q&A extraction, and listening-library workflows. This workflow additionally consumes a local taste.md file to profile the user and can write a new markdown debate artifact to disk, which is not clearly reflected in the stated description of podcast-content operations.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Low

Category: Not specified by scanner
Confidence: 77% confidence
Finding: The workflow frames content loading as tightly scoped to Podwise episode artifacts and explicitly limits transcript use to attribution. However, the dialogue rules later direct the agent to bring in named researchers, events, and competing frameworks, which expands behavior beyond simply debating the episode's extracted claims and relies on extra-episode knowledge not described in the loading/extraction steps.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The skill explicitly instructs the agent to write Anki and CSV files into the current working directory and confirm the path, but it does not require an explicit user warning or opt-in specifically for local file creation. While this is likely intended as a normal export feature, silent file creation can surprise users, create unwanted artifacts on disk, or write sensitive transcript-derived content into an unintended location.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The workflow instructs the agent to write a report file automatically to the current working directory and only inform the user afterward. This creates an unsolicited filesystem side effect that may overwrite expectations, create sensitive research artifacts locally, or violate least-surprise, even though the write behavior is aligned with the skill’s stated purpose.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.