Openclaw Podcast

Transform your OpenClaw workspace into personalized AI-powered podcast briefings. Get daily audio updates on your work, priorities, and strategy in 8 compell...

This skill mostly does what it says: it reads your OpenClaw workspace and sends that content to Superlore.ai to produce TTS episodes. Before installing or running the setup wizard: - Review the scripts (generate-episode.js and setup-crons.js) yourself. They are included and use only Node built-ins, so you can audit what they read and write. - Be aware that running the setup wizard can append your SUPERLORE_API_KEY to ~/.zshrc or ~/.bashrc (persisting the key). Only allow that if you trust storing the key on disk. - The tool will send the contents of your workspace (potentially large / sensitive text) to the Superlore API — consider using a dedicated API key or an account with limited privileges, or avoid saving personal secrets in the briefing data. - The scripts allow overriding the API URL (--api-url). When running them, avoid pointing to unknown endpoints to prevent inadvertent data exfiltration. - The setup wizard imports child_process.execFileSync and may run system commands to help install cron jobs; do not allow it to run commands unless you inspect the commands it will run. Prefer to copy/paste the printed cron commands and run them yourself. If you want lower risk: use the skill in dry-run mode (preview prompts), create a dedicated Superlore API key with limited allowed quota, and do not accept the option to write the key to your shell profile.

Type: OpenClaw Skill Name: openclaw-podcast Version: 1.2.0 The OpenClaw Podcast skill transparently declares its high-risk capabilities, including network access to superlore-api.onrender.com, reading workspace files (memory/*.md, JOBS.md, HEARTBEAT.md, MEMORY.md), and optionally modifying shell profiles (~/.zshrc, ~/.bashrc) and scheduling cron jobs. The `scripts/generate-episode.js` file implements robust sanitization (`stripSecrets`, `sanitizeMemory`) to prevent API keys, tokens, emails, IPs, and agent internal instructions from being sent to the external API, and hardcodes `visibility: 'private'` for episodes. The `scripts/setup-crons.js` script performs shell profile modification and cron job scheduling only with explicit user confirmation. All actions are aligned with the stated purpose of generating personalized podcast briefings, and there is no evidence of malicious intent, obfuscation, or unauthorized data exfiltration.