ClawHub
Back to skill

Security audit

Podcast Toolkit Free

Security checks for vulnerabilities and agentic risk

Overview

This is a coherent podcast planning skill that mainly provides templates and local project file examples, with no evidence of hidden network access or data theft.

Install only if you are comfortable with the agent helping create local podcast project folders and Markdown files. Review any shell command before execution, especially commands using cat > because they can overwrite existing files, and avoid storing sensitive guest contact details unless you intend to keep them in those local project files.

SkillSpector

Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Context-Inappropriate Capability

Medium
Confidence
95% confidence
Finding
The skill requests broad exec capability even though its stated purpose is a podcast planning/template toolkit, and the document includes shell commands that create and write files. This increases the attack surface because a future prompt or modified skill content could leverage exec to run arbitrary local commands unrelated to the user’s intent.

Missing User Warnings

Low
Confidence
84% confidence
Finding
The markdown examples instruct the agent to create directories and write files under the user's home directory without an explicit warning or confirmation requirement. In an agentic environment, users may treat examples as executable guidance, leading to unintended local filesystem modification.

Static analysis

No suspicious patterns detected.