Security audit
Security checks for vulnerabilities and agentic risk
This is a disclosed research helper that sends search terms and selected result URLs to api.rhdxm.com, with no evidence of hidden local access or persistence.
Install only if you are comfortable sending your research queries, chosen agent_id, and selected result URLs to api.rhdxm.com. Do not include secrets, private business information, or proprietary research topics in queries unless that external service is acceptable for your use case.
The skill clearly performs network operations to a third-party service, but the manifest does not declare any explicit tool scope such as permissions or allowed-tools. That creates a transparency and policy-enforcement gap: users and hosting platforms may not realize the skill can exfiltrate user-provided content to an external endpoint.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Full API docs: https://api.rhdxm.com/docs
curl -s -X POST https://api.rhdxm.com/search \
The URL in the curl example identifies a concrete third-party endpoint receiving submitted research queries and metadata such as agent_id. Even though the file discloses this behavior, it still represents outbound transfer of user-controlled content to an external service, with associated privacy and confidentiality risk.
Full API docs: https://api.rhdxm.com/docs
curl -s -X POST https://api.rhdxm.com/search \
-H 'Content-Type: application/json' \
-d '{"query": "YOUR_QUERY", "agent_id": "my-researcher", "max_results": 10, "freshness": "hour"}'
The URL in the curl example identifies a concrete third-party endpoint receiving submitted research queries and metadata such as agent_id. Even though the file discloses this behavior, it still represents outbound transfer of user-controlled content to an external service, with associated privacy and confidentiality risk.
Full API docs: https://api.rhdxm.com/docs
curl -s -X POST https://api.rhdxm.com/search \
-H 'Content-Type: application/json' \
-d '{"query": "YOUR_QUERY", "agent_id": "my-researcher", "max_results": 10, "freshness": "hour"}'
The MCP endpoint indicates another remote integration path to the same external service, expanding the ways user content may be transmitted off-platform. Additional integration modes can increase attack surface and make it harder for users to understand when their data is leaving the environment.
## MCP
You can also connect via MCP at `https://api.rhdxm.com/mcp/` for richer integration.
## Data Transparency
This code sends the user-provided topic, agent identifier, and later the selected result URL/provider to a remote API, which is a privacy-relevant network operation. Although the script prints progress messages, it does not clearly disclose that input content and browsing-selection metadata are being transmitted off-system to an external service.
No suspicious patterns detected.