Security audit

Ai Podcast Free

Security checks across malware telemetry and agentic risk

Overview

This skill is a straightforward text-to-podcast helper that sends user-provided text to MagicPodcast with disclosed API use and no hidden persistence or destructive behavior.

Install only if you are comfortable sending the text you provide to MagicPodcast for audio generation. Avoid submitting secrets, private personal data, regulated information, or confidential business content unless you intend that service to process it, and keep the MagicPodcast API key out of source control.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Vague Triggers

Medium

Confidence: 81% confidence
Finding: The invocation guidance tells the agent to execute tasks by referencing the skill's capabilities without clearly constraining when the skill should activate. In an agent ecosystem, vague activation boundaries can cause the skill to be invoked for loosely related requests, increasing the chance that user content is sent to the external podcast API unexpectedly.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The skill's main description presents the feature as simple text-to-podcast conversion but does not prominently warn that user-provided text will be transmitted to a third-party service. Because users may paste sensitive notes, drafts, or personal content, the absence of an upfront disclosure creates a real privacy and data-handling risk.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.