ClawHub
Back to skill

Security audit

Podcast Generation with Microsoft Foundry

Security checks across malware telemetry and agentic risk

Overview

This skill appears to be a coherent podcast-audio generation helper that uses Azure OpenAI as expected, with privacy considerations but no evidence of hidden or malicious behavior.

Install only if you are comfortable sending podcast prompts, scripts, transcripts, and generated-content context to Azure OpenAI. Do not include secrets, regulated data, or private material unless your organization approves that provider and configuration.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (3)

Missing User Warnings

Medium
Confidence
84% confidence
Finding
The skill instructs users to send prompts and receive transcripts/audio through an external Azure OpenAI WebSocket service without explicitly warning that user content leaves the local environment. In contexts where prompts may contain sensitive data, this can lead to unintentional disclosure to a third-party cloud service and related compliance or privacy issues.

Missing User Warnings

Medium
Confidence
90% confidence
Finding
The document instructs developers to send user-provided script content to Azure OpenAI for remote processing, but it does not mention disclosure, consent, data handling expectations, or sensitivity restrictions. In a podcast-generation skill, user scripts may contain proprietary, personal, or regulated content, so omission of privacy/security guidance can lead to unintended external data exposure.

Missing User Warnings

Medium
Confidence
93% confidence
Finding
The example sends bookmark titles, summaries, and custom query content to Azure OpenAI over a WebSocket, but the documented pattern does not warn that potentially sensitive user data is transmitted to an external service. In a skill intended for full-stack implementation guidance, this omission can cause developers to deploy privacy-impacting behavior without consent, disclosure, or data-handling review.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical
Code
suspicious.exposed_secret_literal
Location
references/code-examples.md:43