podcast-transcript-fetcher

Pass

Audited by Gen Agent Trust Hub on Oct 22, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill uses subprocess.run to invoke the ffmpeg command-line tool for audio compression in scripts/get_transcript.py. This is used to ensure audio files stay within the 25MB limit required by the Groq Whisper API.\n- [EXTERNAL_DOWNLOADS]: The script fetches content from several external domains including podcast RSS feeds (Substack, Transistor.fm, Libsyn, Simplecast), transcription APIs (Taddy, Groq), and content platforms (GitHub Gists, Dropbox). These downloads are necessary for the skill's primary function of retrieving podcast metadata and audio.\n- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from RSS feeds, website scrapes, and PDF transcripts in scripts/get_transcript.py. Since this content is intended to be analyzed by an AI agent, it represents an indirect prompt injection surface. The script performs basic sanitization such as HTML tag removal and unescaping to mitigate accidental instruction processing.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 22, 2026, 02:06 PM