Podfetcher Tools

Search podcasts, browse episodes, and fetch podcast transcripts from Podfetcher using the bundled Node.js CLI, SDK, or MCP server.

This skill appears to do what it claims: it uses Node, accepts a Podfetcher API key, and talks to the Podfetcher API (default https://api.podfetcher.com). Before installing: 1) Be aware you must provide a Podfetcher API key—treat that key like a secret. 2) The registry metadata lists two extra env vars (PODFETCHER_BASE_URL, PODFETCHER_API_KEY_HEADER) as required, but the code treats them as optional overrides; verify which env vars your environment needs. 3) The MCP server enables an agent to call the API using whatever API key you supply—only provide a key with the minimum necessary permissions and avoid using highly privileged keys in untrusted agents. 4) If you need stronger assurance, inspect the included source (src/*.js) yourself or run the CLI in an isolated environment; there are no obvious hidden endpoints, network calls beyond the Podfetcher API, or escalations in the code.

Type: OpenClaw Skill Name: podfetcher-tools Version: 0.5.1 The podfetcher-tools bundle is a well-structured Node.js client for the Podfetcher API, providing CLI, SDK, and MCP interfaces. The code uses native Node.js modules (node:util, node:crypto) and avoids external dependencies, significantly reducing the supply chain attack surface. Security best practices are followed, such as using encodeURIComponent for path parameters and the native URL class for safe endpoint construction in src/sdk.js. No evidence of data exfiltration, malicious execution, or prompt injection was found.