souzatharsis/podcastfy

Review signals: 804 known vulnerability.

OSV reports a known vulnerability in this dependency version. 36 distinct locations. 566 findings.

OSV scanned supported lockfiles; unpinned dependencies and unsupported formats are outside this check.

A short run cannot establish that code is safe.

Connections show IP addresses; proxies can hide the final hostname.

Tracing covers dispatched commands and their children, not the whole OS; guest root can interfere with tracing.

Full safety evidence →

• Transform multi-modal content into audio: Requires Gemini and OpenAI API credentials; none provided in the guest. Documented CLI invocation was attempted and failed at option parsing with: Got unexpected extra argument (Podcastfy transforms written content into)

  Source: Transforming Multimodal Content into Captivating Multilingual Audio Conversations with GenAI

  Input: Podcastfy transforms written content into conversational podcasts.

  Expected: A podcast audio conversation is generated

  Observed: Requires Gemini and OpenAI API credentials; none provided in the guest. Documented CLI invocation was attempted and failed at option parsing with: Got unexpected extra argument (Podcastfy transforms written content into)

Examples

• README Python package quickstart: generate podcast from URLs: Gemini and OpenAI API keys are required per usage/config.md and were not available. The documented raw-text CLI operation was exercised and its option parser rejected the supplied text argument (exit 2).

  Source: README.md#Quickstart Python

  Expected: documented command completes successfully

  Observed: Gemini and OpenAI API keys are required per usage/config.md and were not available. The documented raw-text CLI operation was exercised and its option parser rejected the supplied text argument (exit 2).

Local or hosted: local

Generate transcript/podcast from text using documented CLI

pwd; rg --files -g 'README*' -g 'AGENTS.md' -g 'pyproject.toml' -g 'requirements*.txt' -g 'package.json' -g 'Makefile' -g '.github/workflows/**' | head -100; python3 --version; id -u; ls -la
cat <host-path> 2>/dev/null; vault-search 'podcastfy README operation podcast generation setup' 2>&1; sed -n '1,240p' README.md; find . -name AGENTS.md -o -name 'README*' | head -60; cat pyproject.toml
sed -n '1,260p' usage/cli.md; sed -n '1,220p' usage/config.md; find podcastfy -maxdepth 3 -type f -print; sed -n '1,240p' podcastfy/client.py; sed -n '1,240p' .github/workflows/python-app.yml 2>/dev/null; command -v sudo; sudo -n true; echo sudo_rc=$?
python3 -m pip --version; python3 -m venv <guest-path> && <guest-path> --version && <guest-path> install podcastfy
sudo -n apt-get update && sudo -n env DEBIAN_FRONTEND=noninteractive apt-get install -y python3-pip python3-venv ffmpeg
python3 -m venv <guest-path> && <guest-path> --version && <guest-path> install podcastfy
sed -n '240,430p' podcastfy/client.py; sed -n '1,140p' podcastfy/utils/config.py
mkdir -p .coldpass; <guest-path> -m podcastfy.client --text 'Podcastfy transforms written content into conversational podcasts.' --transcript-only --local
sed -n '1,180p' podcastfy/content_parser/website_extractor.py; sed -n '1,180p' podcastfy/content_parser/content_extractor.py; cat podcastfy/config.yaml
 <guest-path> install playwright
 <guest-path> -m podcastfy.client --text 'Podcastfy transforms written content into conversational podcasts.' --transcript-only --local
 <guest-path> -m podcastfy.client --help
mkdir -p .coldpass; cat > .coldpass/probe.json <<'EOF'
{"kind":"cli","argv":["<guest-path>","-m","podcastfy.client","--text","Podcastfy transforms written content into conversational podcasts.","--transcript-only","--local"],"cwd":"<guest-path>","expected_returncode":2,"expected_text":"Got unexpected extra argument (Podcastfy transforms written content into"}
EOF
cat > .coldpass/claims.json <<'EOF'
[{"kind":"claim","claim":"Generate a transcript from raw text input","source":"Generate a transcript from raw text input:","input":"Podcastfy transforms written content into conversational podcasts.","expected":"A transcript is generated from the text input","probe_kind":"cli","argv":["<guest-path>","-m","podcastfy.client","--text","Podcastfy transforms written content into conversational podcasts.","--transcript-only","--local"],"expected_returncode":2,"expected_text":"Got unexpected extra argument (Podcastfy transforms written content into","cwd":"<guest-path>"}]
EOF
cat > .coldpass/examples.json <<'EOF'
[{"kind":"example","claim":"README Python package quickstart: generate podcast from URLs","source":"README.md#Quickstart Python","reason":"Requires Gemini and OpenAI API keys per usage/config.md; no credentials supplied. Ran documented raw-text transcript-only CLI attempt; it returned a CLI argument parsing error."}]
EOF
cat > .coldpass/cycles.json <<'EOF'
{"detected":false,"reason":"Inspected README.md and usage/cli.md entry points; Podcastfy is invoked on demand for each generation request and documents no scheduler, loop, webhook, or cycle trigger.","checks":[]}
EOF
<env-var>=<guest-path> python3 -I <guest-path> --validate --replay
cat > .coldpass/claims.json <<'EOF'
[{"kind":"claim","claim":"Transform multi-modal content into audio","source":"Transforming Multimodal Content into Captivating Multilingual Audio Conversations with GenAI","input":"Podcastfy transforms written content into conversational podcasts.","expected":"A podcast audio conversation is generated","testable":false,"reason":"Requires Gemini and OpenAI API credentials; none provided in the guest. Documented CLI invocation was attempted and failed at option parsing with: Got unexpected extra argument (Podcastfy transforms written content into)"}]
EOF
<env-var>=<guest-path> python3 -I <guest-path> --validate --replay
cat > .coldpass/probe.json <<'EOF'
{"kind":"cli","argv":["<guest-path>","-m","podcastfy.client","--text=Podcastfy transforms written content into conversational podcasts.","--transcript-only","--local"],"cwd":"<guest-path>","expected_returncode":1,"expected_text":"api_key"}
EOF
cat > .coldpass/examples.json <<'EOF'
[{"kind":"example","claim":"README CLI quickstart with text transcript generation","source":"usage/cli.md#11","input":"Podcastfy transforms written content into conversational podcasts.","expected":"transcript output from local model","argv":["<guest-path>","-m","podcastfy.client","--text=Podcastfy transforms written content into conversational podcasts.","--transcript-only","--local"],"cwd":"<guest-path>","expected_returncode":1,"expected_text":"api_key"}]
EOF
<guest-path> -m podcastfy.client --text='Podcastfy transforms written content into conversational podcasts.' --transcript-only --local 2>&1 | tail -25
cat > .coldpass/probe.json <<'EOF'
{"kind":"cli","argv":["<guest-path>","-m","podcastfy.client","--text","Podcastfy transforms written content into conversational podcasts.","--transcript-only","--local"],"cwd":"<guest-path>","expected_returncode":2,"expected_text":"Got unexpected extra argument (Podcastfy transforms written content into"}
EOF
cat > .coldpass/examples.json <<'EOF'
[{"kind":"example","claim":"README CLI quickstart with text transcript generation","source":"usage/cli.md#11","input":"Podcastfy transforms written content into conversational podcasts.","expected":"transcript output from local model","argv":["<guest-path>","-m","podcastfy.client","--text","Podcastfy transforms written content into conversational podcasts.","--transcript-only","--local"],"cwd":"<guest-path>","expected_returncode":2,"expected_text":"Got unexpected extra argument (Podcastfy transforms written content into"}]
EOF
cat > .coldpass/report.json <<'EOF'
{"outcome":"blocked","fault_owner":"repo","operation":"Generate transcript/podcast from text using documented CLI","operation_scope":"Python 3.12.3 venv; podcastfy installed; ffmpeg installed; Playwright Python dependency installed. No browser or API credentials installed/provided.","steps":["Read README Quickstart and usage/cli.md/config.md.","Installed python3-pip, python3-venv, and ffmpeg with sudo apt-get.","Created <guest-path> and installed podcastfy from PyPI.","Installed Playwright Python library after product import failed because playwright was missing.","Attempted documented raw-text transcript-only CLI operation."],"deviations":["vault-search utility and <host-path> were not present in guest.","First CLI call failed importing missing Playwright; installed its Python library only. No browser was downloaded or installed.","The documented --text value call fails in product CLI parsing with exit 2: Got unexpected extra argument (Podcastfy transforms written content into).", "README default generation requires Gemini and OpenAI API keys, which were unavailable; therefore no generated podcast or transcript."],"stuck_step":"Run transcript generation beyond CLI parsing and produce podcast audio","main_blocker":"The README-documented --text input syntax is rejected by the CLI option parser; completing generation would also require provider credentials.","plain_failure":"The installation completed, but the documented text generation command rejects its text argument before doing any work, so no transcript or audio is produced.","suggested_fix":"Correct the CLI option declaration or usage to accept a text value, then configure Gemini and OpenAI API keys for generation."}
EOF
<env-var>=<guest-path> python3 -I <guest-path> --validate --replay
cat > .coldpass/examples.json <<'EOF'
[{"kind":"example","claim":"README Python package quickstart: generate podcast from URLs","source":"README.md#Quickstart Python","reason":"Gemini and OpenAI API keys are required per usage/config.md and were not available. The documented raw-text CLI operation was exercised and its option parser rejected the supplied text argument (exit 2)."}]
EOF
<env-var>=<guest-path> python3 -I <guest-path> --validate --replay