pp-podcastindex
Pass
Audited by Gen Agent Trust Hub on Jul 13, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill requires the installation of the podcastindex-pp-cli binary from the author's GitHub repository and npm package. These are standard installation procedures for the tool.
- [COMMAND_EXECUTION]: The skill executes the podcastindex-pp-cli binary with various arguments to perform podcast metadata searches and analysis.
- [PROMPT_INJECTION]: The skill processes untrusted external data (podcast metadata and transcripts) from the PodcastIndex API, creating a surface for indirect prompt injection. (1) Ingestion points: Data enters the context through search results and transcripts (e.g., tgrep command) in SKILL.md. (2) Boundary markers: No explicit delimiters or instructions are provided to treat the retrieved content as untrusted. (3) Capability inventory: The skill has the ability to write results to local files or send them to external webhooks using the --deliver flag. (4) Sanitization: There is no documented validation or filtering of the content retrieved from the external API.
Audit Metadata