Back to skill
Skillv0.2.0
ClawScan security
podwise-podcast-copilot · ClawHub's context-aware review of the artifact, metadata, and declared behavior.
Scanner verdict
BenignMar 20, 2026, 7:00 AM
- Verdict
- Benign
- Confidence
- high
- Model
- gpt-5-mini
- Summary
- The skill's instructions align with a Podwise CLI helper: it expects a local podwise CLI and configured API key and asks for user confirmation before uploads/processing; there are no unrelated or disproportionate requirements.
- Guidance
- This is an instruction-only helper for the Podwise CLI and appears coherent with that purpose, but before installing/using it: (1) ensure you have the official podwise CLI from a trusted source; (2) be aware that running `podwise config show` may reveal API keys or sensitive settings — check where Podwise stores credentials (config file, keychain, or env vars) and whether you are comfortable exposing them to the agent; (3) the skill will upload local audio/video if you confirm processing — only upload files you are comfortable sending to Podwise and confirm quota/privacy costs when prompted; (4) if you need stronger guarantees, run the podwise commands yourself (or inspect outputs) rather than allowing the agent to run them autonomously. If any of these are unacceptable, do not enable the skill.
Review Dimensions
- Purpose & Capability
- okThe name and description match the instructions: the SKILL.md is a CLI-driven podcast copilot that runs podwise commands (search, ask, process, get, list, popular). Nothing in the skill's content requests access to services or credentials unrelated to Podwise or handling podcast/audio inputs.
- Instruction Scope
- noteInstructions tell the agent to run podwise commands and to inspect podwise help and podwise config show. This is appropriate for a CLI helper, but podwise config show may surface API key/credentials or other sensitive config. The runtime also includes uploading local audio/video files (podwise process <file>), which sends local data to Podwise — the skill correctly requires confirmation before doing so, but users should be aware of the privacy/quotas implications.
- Install Mechanism
- okNo install spec or external downloads are included (instruction-only skill). This is low-risk: nothing is written to disk by the skill package itself and it relies on an existing podwise binary.
- Credentials
- noteThe skill metadata declares no required env vars, yet the instructions assume an API key is configured for the podwise CLI. This is coherent if CLI auth is stored in a local config rather than environment variables, but it's a mismatch with the metadata: the skill doesn't declare where or how credentials are stored. Users should verify where podwise holds credentials (config files, keychain, env) before running commands that reveal or use them.
- Persistence & Privilege
- okThe skill does not request permanent presence (always:false) and does not include installation steps that modify other skills or global agent settings. Autonomous invocation is allowed (platform default) and is appropriate for this helper.