Security audit
Security checks for vulnerabilities and agentic risk
This podcast skill is not clearly malicious, but it can send user text or PDF links to an external service and its activation scope is broader than that purpose.
Install only if you intend to use MagicPodcast and are comfortable sending pasted text or public PDF URLs to that service. Avoid private, confidential, internal, or tokenized document links, and invoke it only for podcast generation rather than general file conversion or content extraction.
The manifest description advertises broad file processing, document conversion, format conversion, and content extraction capabilities, which can cause the skill to be selected for unrelated tasks. Because the actual implementation routes data to a remote third-party API, this mismatch materially increases the risk of unintended data disclosure through accidental invocation.
The trigger condition is broad enough to match many ordinary document-processing or file-conversion requests, even though the skill actually transmits content to an external podcast API. In an agent environment, overbroad activation can cause sensitive user text or document links to be sent off-platform without clear, task-specific consent.
The manifest description says to use the skill for broad '文件处理、文档转换、格式互转、内容提取' scenarios, which implies a more general-purpose document-processing capability. However, the rest of the file documents only specific network calls to MagicPodcast endpoints that create podcasts from text or PDF URLs, not generic file conversion or extraction behavior.
The manifest description states '支持中文交互' as part of the skill behavior, which can be read as a default language constraint. Since policy requires avoiding forced language/locale behavior without opt-in, this is problematic, especially because the document later presents the tool as supporting multiple languages.
The natural-language summary lists Chinese interaction as a built-in behavior rather than an option chosen by the user. On its face, this can violate language-choice policy because it does not offer user opt-in or indicate that other languages are available despite later claims of multilingual support.
The feature matrix states '音频下载 | 否 | PRO 版支持', which limits free-version output capabilities. Later, the generic output section says the skill supports '导出/保存/转换操作', which contradicts the earlier free-version limitation and could mislead users about what output actions are actually available.
This skill sends user-provided text content and language selection to an external MagicPodcast API using curl. In context, the skill is marketed broadly for document/content processing, so users may provide sensitive material without realizing it will be transmitted to a third party, creating a real confidentiality risk.
# 从文本创建播客
payload="$(jq -n --arg text "$SOURCE_TEXT" --arg language "$LANGUAGE" '{text:$text,language:$language}')"
curl -sS -X POST "$MAGICPODCAST_API_URL/agent/v1/podcasts/text" \
-H "Content-Type: application/json" \
-H "x-api-key: $MAGICPODCAST_API_KEY" \
--data-binary "$payload"
The skill sends a user-supplied PDF URL to an external service for processing, which reveals the document location and may trigger third-party access to the linked resource. While less severe than directly uploading document contents, it still creates a privacy and data-governance risk, especially if the URL embeds access tokens or references internal resources.
payload="$(jq -n --arg pdfUrl "$PDF_URL" --arg language "$LANGUAGE" '{pdfUrl:$pdfUrl,language:$language}')"
curl -sS -X POST "$MAGICPODCAST_API_URL/agent/v1/podcasts/pdf" \
-H "Content-Type: application/json" \
-H "x-api-key: $MAGICPODCAST_API_KEY" \
--data-binary "$payload"
The skill states that user input should not be concatenated into command-line parameters, yet it operationalizes user-controlled values in shell-driven curl/jq workflows. Although the examples use quoting and jq --arg, the skill still encourages an exec-based pattern where future modifications or adjacent commands may unsafely reuse these variables, increasing the chance of command injection or unsafe shell handling in agent execution contexts.
The manifest explicitly says 'PDF、文本、链接转为双人对话播客', suggesting a dedicated link-to-podcast path. In the file content, the concrete operations only demonstrate POST requests for text input and PDF URL input, with no separate link/article-fetch workflow shown.
No suspicious patterns detected.