Transistor FM

Manage podcasts on Transistor.fm via their API. Use when creating, publishing, updating, or deleting podcast episodes, uploading audio files, listing shows/e...

This skill appears to do what it says (manage Transistor.fm via their API) but there are important inconsistencies and missing provenance you should address before installing. Specifically: (1) the SKILL.md requires an API key (it suggests TRANSISTOR_API_KEY) but the registry metadata doesn't declare it — treat that as a red flag and assume the agent will need that secret. (2) The doc refers to a missing references/api.md and uses undefined variables ($BASE, $KEY), so test in a safe environment first. (3) Avoid granting the agent broad access to a secrets manager; instead provide only the Transistor API key and only to the skill's scope if possible. (4) Because the skill's source/homepage are unknown, prefer to use an official or well-documented plugin from a trusted publisher, or manually implement the minimal curl commands yourself. If you proceed, limit the agent's secret access to a single TRANSISTOR_API_KEY and monitor requests to ensure it only calls api.transistor.fm and uploads files you expect.

Type: OpenClaw Skill Name: transistorfm Version: 1.0.0 The skill's stated purpose is legitimate Transistor.fm API interaction. However, the `SKILL.md` includes instructions for uploading local files using `curl -T /path/to/episode.mp3`. While this is necessary for the stated purpose of uploading audio files, it introduces a significant vulnerability. An AI agent executing these instructions could potentially be prompted via prompt injection to upload arbitrary sensitive files from its host system to Transistor.fm's authorized upload URLs, leading to data exfiltration. This capability, though not malicious in intent, presents a high risk of abuse, classifying it as suspicious.