Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

Weryai Podcast Generator

v0.1.2

Generate, query, and deliver WeryAI podcasts through the official podcast generation API. Use when the user needs podcast speaker lookup, podcast text genera...

0· 136·0 current·0 all-time

Install

OpenClaw Prompt Flow

Install with OpenClaw

Best for remote or guided setup. Copy the exact prompt, then paste it into OpenClaw for weryai-developer/weryai-podcast-generator.

Previewing Install & Setup.
Prompt PreviewInstall & Setup
Install the skill "Weryai Podcast Generator" (weryai-developer/weryai-podcast-generator) from ClawHub.
Skill page: https://clawhub.ai/weryai-developer/weryai-podcast-generator
Keep the work scoped to this skill only.
After install, inspect the skill metadata and help me finish setup.
Required env vars: WERYAI_API_KEY, WERYAI_BASE_URL
Required binaries: node
Use only the metadata you can verify from ClawHub; do not invent missing requirements.
Ask before making any broader environment changes.

Command Line

CLI Commands

Use the direct CLI path if you want to install manually and keep every step visible.

OpenClaw CLI

Bare skill slug

openclaw skills install weryai-podcast-generator

ClawHub CLI

Package manager switcher

npx clawhub@latest install weryai-podcast-generator
Security Scan
VirusTotalVirusTotal
Benign
View report →
OpenClawOpenClaw
Benign
high confidence
Purpose & Capability
Name/description, required binaries (node), and required env vars (WERYAI_API_KEY, WERYAI_BASE_URL) align with a client that calls WeryAI podcast generation endpoints. The included scripts map cleanly to the declared intents (speakers, submit-text, generate-audio, status, wait).
Instruction Scope
SKILL.md limits actions to listing speakers, submitting text, triggering audio, and polling for status. The code additionally supports uploading local files (resolvePublicUrlFromSource / uploadLocalFileToPublicUrl) — which will read local files and POST them to the configured WeryAI upload endpoint. This is reasonable for a media-generation client, but SKILL.md does not prominently call out local-file reads/uploads or the optional WERYAI_ALLOW_INSECURE_UPLOAD toggle. If the agent is allowed to run scripts with file-path inputs, be aware files can be read and uploaded to the API base URL (or to an overridden base URL if set).
Install Mechanism
No install spec — this is instruction/code-only and does not download remote archives or run an installer. All code is included in the package; no external install URLs or extract operations are present.
Credentials
The primary credential (WERYAI_API_KEY) and base URL are appropriate and expected. The package also reads an undocumented environment variable WERYAI_ALLOW_INSECURE_UPLOAD (to suppress a warning when uploading to a non-official domain) and uses ctx.* settings like requestTimeoutMs or verbose; these are typical but worth knowing. No unrelated high-privilege credentials are requested.
Persistence & Privilege
always:false and normal autonomous invocation settings. The skill does not request permanent platform-wide elevation or modify other skills. It only operates within its own scripts and runtime context.
Assessment
This skill appears to be what it says: a Node-based client for the WeryAI podcast API. Before installing, note: (1) you must provide a WERYAI_API_KEY (and optionally WERYAI_BASE_URL); keep that key secret. (2) Running submit-text/generate-audio/wait may consume paid credits. (3) The code can read local file paths you supply and upload those files to the configured base URL — do not pass sensitive files or allow the base URL to be overridden to an untrusted host. (4) There is an undocumented env var WERYAI_ALLOW_INSECURE_UPLOAD that, if set, suppresses warnings about non-official upload domains; do not set it unless you trust the endpoint. Use dry-run first (scripts support --dry-run) to verify request shapes and avoid unintended spending.
scripts/vendor/weryai-core/upload.js:147
Environment variable access combined with network send.
!
scripts/vendor/weryai-core/upload.js:131
File read combined with network send (possible exfiltration).
Patterns worth reviewing
These patterns may indicate risky behavior. Check the VirusTotal and OpenClaw results above for context-aware analysis before installing.

Like a lobster shell, security has layers — review code before you run it.

Runtime requirements

🎙️ Clawdis
Binsnode
EnvWERYAI_API_KEY, WERYAI_BASE_URL
Primary envWERYAI_API_KEY
latestvk97e7c5yhs942a4bhnjh8kqcs183h79v
136downloads
0stars
3versions
Updated 1mo ago
v0.1.2
MIT-0

WeryAI Podcast Generator

Generate podcasts through the official WeryAI podcast API. This skill covers the full workflow: list available voices, submit podcast text generation, trigger audio generation, and wait until the final audio is ready.

Example Prompts

  • List the English podcast speakers available on WeryAI.
  • Generate a short English podcast about AI in healthcare with two speakers and give me the final audio URL.
  • Submit podcast text generation for this topic and stop after the text task is created.
  • Generate podcast audio for this existing podcast task ID.
  • Check whether this WeryAI podcast task already reached audio-success.

Quick Summary

  • Main jobs: speaker lookup, podcast text generation, podcast audio generation, podcast task status, full podcast wait
  • Required paid inputs: query, speakers, language
  • Generation modes: quick, debate, deep
  • Default mode: quick
  • Preferred entrypoint: wait.js for end-to-end text -> audio flow
  • Main trust signals: dry-run support, explicit speaker requirement, documented debate rule, podcast-aware polling on content_status

Authentication and first-time setup

Before the first paid run:

  1. Create a WeryAI account.
  2. Open https://www.weryai.com/api/keys.
  3. Create an API key and copy the secret value.
  4. Add it to WERYAI_API_KEY.
  5. Make sure the account has available balance before running paid podcast generation.

Quick verification

Use one safe check before the first paid run:

node scripts/speakers.js --language en
node scripts/wait.js --json '{"query":"What is retrieval augmented generation?","speakers":["travel-girl-english","leo-9328b6d2"],"language":"en","mode":"quick"}' --dry-run
  • speakers.js confirms the key is configured and the podcast voice list is reachable.
  • --dry-run confirms the full request shape locally without spending credits.

Prerequisites

  • WERYAI_API_KEY must be set before calling the API.
  • Optional override WERYAI_BASE_URL defaults to https://api.weryai.com. Only override it with a trusted host.
  • Node.js >=18 is required.
  • Real submit-text, generate-audio, and wait runs may consume WeryAI credits.
  • Paid submit-text and wait runs require explicit speakers; do not assume or auto-pick hidden speakers.

Supported intents

  • podcast voices, podcast speakers, available voices -> speakers.js
  • create a podcast from this topic, generate a podcast episode, make a spoken podcast -> wait.js
  • submit podcast text only -> submit-text.js
  • start podcast audio for this task -> generate-audio.js
  • check this podcast task -> status.js

Generation modes

  • quick: fastest default mode for short topic-driven podcast generation
  • debate: structured two-speaker debate format
  • deep: longer or more detailed generation mode

Important rule:

  • debate mode requires exactly 2 speakers.

Recommended guidance pattern

Use short operator-style guidance like this:

  • General help: When the user asks "how to use this skill", DO NOT paste raw shell commands. Instead, explain the capabilities in natural language and give 2-3 prompt examples.

Workflow

  1. If the user has not chosen speakers yet, run speakers.js --language <code> first.
  2. Confirm the final query, speakers, language, and mode.
  3. Prefer wait.js for end-to-end delivery.
  4. wait.js submits podcast text generation, polls until content_status=text-success, triggers audio generation, then polls until content_status=audio-success. Enforce bounded polling with a maximum timeout of 30 minutes (1800 seconds); do not run unbounded loops.
  5. Return the final audio URLs and task state.

Commands

# Full end-to-end run
node scripts/wait.js --json '{"query":"What are the breakthrough applications of artificial intelligence in healthcare?","speakers":["travel-girl-english","leo-9328b6d2"],"language":"en","mode":"quick"}'

# Inspect a podcast task
node scripts/status.js --task-id <task-id>

User-facing delivery requirement

  • Always render the final audios URLs directly to the user as clickable Markdown links. Do not just output the taskId.
  • If multiple audio tracks are generated, render all of them using markdown links consecutively.
  • Include a brief summary of the generation parameters used (e.g. from requestSummary or your initial choices).
  • If timeout is reached before completion, return the taskId to the user and ask if they want you to check the status again. Do NOT show the raw node status command to the user; use it internally to check the status when asked.

Definition of Done

  • speakers.js returns at least one speaker for the requested language, or a clear API failure.
  • submit-text.js returns a real taskId.
  • wait.js reaches content_status=audio-success and returns user-visible final audio URLs,
  • or wait.js reaches timeout and returns the taskId plus an offer to check status again later,
  • or a clear failure with task state and next step.

Re-run Behavior

  • Re-running speakers.js is read-only and safe.
  • Re-running status.js is read-only and safe.
  • Re-running submit-text.js, generate-audio.js, or wait.js may create or advance paid podcast work and may consume additional credits.

Boundaries

  • Do not use this skill for music-only generation; use weryai-music-generator.
  • Do not use this skill for general chat or writing-only requests; use weryai-chat or other text/* skills.
  • Do not invent undocumented podcast fields beyond query, speakers, language, mode, scripts, webhook_url, and caller_id.

References

Comments

Loading comments...