ai-podcast-free

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:24 AM UTC
• Version: 1.0.2

Overview

This skill appears to generate podcasts as advertised, but it asks for broader agent powers than its workflow needs and contains mismatched capability claims.

Install only if you are comfortable with your submitted text being sent to MagicPodcast and with the agent receiving read/write/exec capabilities for this skill. Avoid sensitive or confidential text, verify the API URL stays on the intended MagicPodcast HTTPS host, and treat the extra translation, voice customization, PDF, file-processing, and command-execution claims as unsupported unless the publisher narrows or documents them.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:85

Finding

API Credentials and User Content Can Be Redirected Through a Mutable API Base URL

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:85-133
Vulnerability Type: Unvalidated external service destination
Risk Level: Medium

Vulnerable Code

bash

export MAGICPODCAST_API_URL="https://api.magicpodcast.app"
export MAGICPODCAST_API_KEY="${API_KEY:?Please set the environment variable}"

bash

payload="$(jq -n --arg text "$SOURCE_TEXT" --arg language "$LANGUAGE" '{text:$text,language:$language}')"
# ...
curl -sS -X POST "$MAGICPODCAST_API_URL/agent/v1/podcasts/text" \
  -H "Content-Type: application/json" \
  -H "x-api-key: $MAGICPODCAST_API_KEY" \
  --data-binary "$payload"

bash

if ! safe_job_id "$JOB_ID"; then
  echo "Invalid job id" >&2
  exit 1
fi
# ...
curl -sS "$MAGICPODCAST_API_URL/agent/v1/jobs/$JOB_ID" \
  -H "x-api-key: $MAGICPODCAST_API_KEY"

Technical Analysis

The API endpoint is constructed from the mutable MAGICPODCAST_API_URL environment variable. The instructions do not verify that its effective value uses HTTPS or that its hostname is exactly api.magicpodcast.app.

Both API operations attach MAGICPODCAST_API_KEY through the x-api-key header. The creation request also sends the complete user-supplied source text. Consequently, a modified process environment can redirect credentials and potentially sensitive content to an unintended endpoint.

Although the documented default points to the expected HTTPS service, assigning a secure default is not equivalent to validating the value at execution time. The job-ID validation does not protect the endpoint or the API key.

Attack Path

1. An attacker with influence over the Agent's environment, launch configuration, shell profile, or workflow variables sets MAGICPODCAST_API_URL to an attacker-controlled endpoint.
2. A user invokes the Skill and supplies text for podcast generation.
3. The Agent constructs the request URL from the poisoned environment variable.
4. curl se ...[truncated 746 chars]

Remediation

View remediation

Remediation Suggestions

• Hardcode the trusted base URL when endpoint customization is unnecessary:

  bash

  readonly MAGICPODCAST_API_URL="https://api.magicpodcast.app"
  

• If configurability is required, parse and validate the URL before attaching credentials. Require the exact https scheme and an explicit allowlist of trusted hostnames.
• Reject URLs containing user information, unexpected ports, fragments, or nonstandard hostname representations.
• Configure curl to use HTTPS only:

  bash

  curl --proto '=https' --tlsv1.2 ...
  

• Avoid following redirects for authenticated requests. If redirects are required, validate every redirect destination and ensure credentials are not forwarded across origins.
• Fail closed when endpoint validation fails, before reading or transmitting source text.
• Use a narrowly scoped API key, rotate any key suspected of exposure, and monitor the external service for unauthorized use.

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: SKILL.md:24

Finding

Skill Declares Filesystem and Command-Execution Capabilities Beyond Its Functional Requirements

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:24-27
Vulnerability Type: Excessive Agent tool permissions
Risk Level: Medium

Vulnerable Code

yaml

tools:
- read
- exec
- write

The document later describes broad capabilities unrelated to the core text-to-podcast operation:

markdown

- **File processing**: Supports reading, parsing, and writing multiple file formats
- **Command execution**: Executes system commands in a secure sandbox and collects results

Technical Analysis

The Skill's documented core behavior consists of sending text to an HTTPS API and querying task status. General filesystem reading, filesystem writing, and unrestricted command execution are broader capabilities than this workflow requires.

This violates least-privilege design. If malicious user content, compromised external data, or another instruction-confusion condition causes the Agent to misuse available tools, these declarations increase the reachable local attack surface. A purpose-built API tool would not need arbitrary file access or general shell execution.

The declarations do not independently prove that a privilege escalation has already occurred. The security issue is that the Skill requests capabilities beyond its legitimate operational scope, making a separate prompt-injection or instruction-confusion event substantially more consequential.

Attack Path

1. The Skill is installed or loaded with its declared read, write, and exec capabilities.
2. The Agent receives malicious or misleading task content that induces tool use outside the podcast-generation workflow.
3. Because the Skill has broad tools available, the Agent may read local files, write or overwrite accessible files, or run shell commands rather than limiting activity to the intended API calls.
4. Any resulting access occurs with the operating-system identity and sandbox permissions assigned to the Agent process.
5. D ...[truncated 522 chars]

Remediation

View remediation

Remediation Suggestions

• Remove the read and write tools unless a concrete, documented podcast workflow requires local file handling.
• Replace general exec access with a dedicated HTTP/API tool restricted to the MagicPodcast endpoints and required methods.
• If shell execution is unavoidable, allowlist the exact executable and fixed argument structure rather than permitting arbitrary commands.
• Restrict outbound network access to api.magicpodcast.app over HTTPS.
• Run the Skill in a sandbox with a minimal filesystem view, no access to unrelated credentials, and a nonprivileged operating-system identity.
• Require explicit user approval for any filesystem operation or command that falls outside the API workflow.
• Remove unsupported generic claims about file processing and command execution so that the documented capability boundary matches the implementation.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (7)

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The manifest description says the skill converts plain text into a two-host podcast, but it also instructs users to use it for '文本翻译、多语言转换、本地化处理'. The implementation shown in the file only sends text and a target language to MagicPodcast for podcast generation/status lookup, with no translation or localization workflow described in code.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The invocation wording is overly broad and lacks clear scope constraints, increasing the chance that the agent will select this skill for loosely related requests such as translation or localization. Because the skill sends user content to an external service, overbroad triggering can lead to unintended disclosure of user text or misuse of privileged tools in the wrong context.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill omits an upfront warning that user text and callback URLs are transmitted to a third-party service, which undermines informed consent and safe handling of sensitive data. Users may provide confidential content or internal callback endpoints without realizing they will leave the local environment.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 91% confidence

Finding

This code transmits user-supplied text to an external API, which is expected for the feature but still represents a real data-exfiltration boundary. In this skill's context, the danger is not the existence of the network call itself, but that it can carry sensitive user content off-platform if scope and consent are not tightly controlled.

Content

Scanner excerpt · SKILL.md (reported line 118)May include surrounding context.

bash

payload="$(jq -n --arg text "$SOURCE_TEXT" --arg language "$LANGUAGE" '{text:$text,language:$language}')"
# ...
curl -sS -X POST "$MAGICPODCAST_API_URL/agent/v1/podcasts/text" \
  -H "Content-Type: application/json" \
  -H "x-api-key: $MAGICPODCAST_API_KEY" \
  --data-binary "$payload"

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The FAQ states users can choose host voice style, gender, age, and accent, but the documented request payload only includes 'text' and 'language'. Elsewhere the capability list and examples also omit any voice-style parameter, so the documentation actively overstates what the skill does.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The skill claims generic file processing, search, and command-execution capabilities that exceed its actual podcast workflow, which can cause an agent to invoke read/write/exec primitives more broadly than necessary. In an agent environment, overstating capabilities and tool scope increases the chance of unnecessary local file access or shell execution, expanding the attack surface beyond the stated user task.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

The ability boundary clearly says the skill only supports plain text and not PDF/URL input. Later sections tout file parsing, multiple file-format handling, and even 'PDF转播客' as a feature comparison point, which contradicts the stated capability limits for this skill version.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.