Podcast Transcribe

For transcript or subtitle requests involving podcast URLs, public audio URLs/files, or raw transcript cleanup. Generates audio + SRT + TXT artifacts and can...

This skill appears to do what it says (transcribe podcasts) but relies heavily on a third‑party CLI (podcast-helper) that will be fetched and executed at runtime via npx/pnpm. Before installing or running: 1) verify the source package (check the npm package name and GitHub repo, confirm the maintainer), 2) prefer running npx in an isolated environment or inspect the package contents first, 3) do not provide API keys until you confirm which provider will be used and that you trust that provider’s code, 4) note the setup docs reference 'dairui1/podcast-helper' whereas the registry owner differs — confirm provenance, and 5) if you need stronger assurance, request a packaged skill with an explicit install spec or a vetted release (GitHub releases) rather than relying on npx remote execution.

Type: OpenClaw Skill Name: podcast-transcribe Version: 1.4.1 The skill bundle is classified as suspicious because it requests broad, high-risk permissions and includes instructions that could lead to the exposure of sensitive credentials. Specifically, SKILL.md grants unrestricted network access via Bash(curl:*) and the ability to execute packages via npx, while references/inputs-and-engines.md encourages the agent to run printenv on sensitive API keys (e.g., ELEVENLABS_API_KEY) for debugging. Although these capabilities are plausibly needed for fetching and transcribing podcast content, the unrestricted nature of the permissions and the potential for secret leakage through command output represent significant security vulnerabilities without clear evidence of malicious intent.