pp-tella
Facilitates Tella API operations via CLI, enabling efficient video management and transcript searches with local SQLite support.
Install this skill
Security score
The pp-tella skill was audited on Jun 6, 2026 and we found 24 security issues across 3 threat categories, including 1 high-severity. Review the findings below before installing.
Categories Tested
Security Issues
Webhook reference - potential data exfiltration
| 3 | description: "Every Tella API operation behind one CLI, with a local SQLite store, FTS5 transcript search, and webhook tooling... Trigger phrases: `search tella transcripts`, `find tella videos`, `lis |
Webhook reference - potential data exfiltration
| 43 | Reach for tella-pp-cli when you need agent-shaped Tella operations: scripted batch edits across a playlist, cross-video transcript search for an agent, webhook handler development without a tunnel, or |
Webhook reference - potential data exfiltration
| 59 | - **`videos viewed`** — Roll up webhook view-milestone events into a per-video summary over a window (e.g. who crossed 75% in the last 7 days). |
Webhook reference - potential data exfiltration
| 75 | ### Webhook tooling |
Webhook reference - potential data exfiltration
| 77 | - **`webhooks tail`** — Stream new webhook events from the inbox to stdout, and replay any prior message to a local URL with valid HMAC headers — no public tunnel needed. |
Webhook reference - potential data exfiltration
| 79 | _Use this when developing a webhook handler against Tella without exposing localhost via a tunnel._ |
Webhook reference - potential data exfiltration
| 82 | tella-pp-cli webhooks tail --follow --json |
Webhook reference - potential data exfiltration
| 118 | - **`exports wait`** — Kick off exports for one or more videos and block until each is ready, short-circuiting on the Export ready webhook event. |
Webhook reference - potential data exfiltration
| 161 | **webhooks** — Webhook endpoint management |
Webhook reference - potential data exfiltration
| 163 | - `tella-pp-cli webhooks create-endpoint` — Creates a new webhook endpoint to receive events. Returns the endpoint ID and signing secret. |
Webhook reference - potential data exfiltration
| 164 | - `tella-pp-cli webhooks delete-endpoint` — Permanently deletes a webhook endpoint |
Webhook reference - potential data exfiltration
| 165 | - `tella-pp-cli webhooks get-endpoint-secret` — Retrieves the signing secret for a webhook endpoint. Use this to verify incoming webhook payloads. |
Webhook reference - potential data exfiltration
| 166 | - `tella-pp-cli webhooks get-message` — Returns details of a specific webhook message by ID |
Webhook reference - potential data exfiltration
| 167 | - `tella-pp-cli webhooks list-messages` — Returns a list of recently sent webhook messages for debugging purposes |
Webhook reference - potential data exfiltration
| 195 | Reads cached webhook view-milestone events grouped by video and viewer. |
Webhook reference - potential data exfiltration
| 205 | ### Develop a webhook handler without ngrok |
Webhook reference - potential data exfiltration
| 208 | tella-pp-cli webhooks tail --once --json |
Webhook reference - potential data exfiltration
| 209 | tella-pp-cli webhooks replay <msg-id> --to http://localhost:8080/webhooks |
Webhook reference - potential data exfiltration
| 212 | `webhooks tail` snapshots the inbox; `webhooks replay <msg-id>` re-POSTs that message to a local URL with valid HMAC headers via the endpoint signing secret. |
Webhook reference - potential data exfiltration
| 279 | | `webhook:<url>` | POST the output body to the URL (`application/json` or `application/x-ndjson` when `--compact`) | |
Webhook reference - potential data exfiltration
| 281 | Unknown schemes are refused with a structured error naming the supported set. Webhook failures return non-zero and log the URL + HTTP status on stderr. |
Ngrok tunnel reference
| 205 | ### Develop a webhook handler without ngrok |
Access to hidden dotfiles in home directory
| 267 | Entries are stored locally at `~/.tella-pp-cli/feedback.jsonl`. They are never POSTed unless `TELLA_FEEDBACK_ENDPOINT` is set AND either `--send` is passed or `TELLA_FEEDBACK_AUTO_SEND=true`. Default |
External URL reference
| 209 | tella-pp-cli webhooks replay <msg-id> --to http://localhost:8080/webhooks |