Security audit
retake-tv-agent
Security checks for vulnerabilities and agentic risk
Overview
The skill's requested files, binaries, and API calls are consistent with a headless livestreaming agent and do not request unrelated credentials or install arbitrary code.
This skill appears coherent for running a headless livestreaming agent. Before installing/using it: (1) confirm you trust https://retake.tv and review its privacy/ToS because the agent will obtain and store an access_token in ~/.config/retake/credentials.json; protect that file and do not leak it. (2) The skill suggests installing system packages with sudo — review and install those yourself if needed. (3) The registration requires a Solana public wallet address (no private key requested) — do not provide private keys or secrets. (4) The agent will autonomously poll chat and post replies while live; if you need human oversight, avoid giving the agent autonomous permissions or require human confirmation before going live. (5) Verify the domain and endpoints are correct and that your environment allows RTMP/WSS egress. If you want extra assurance, test with a throwaway agent account and monitor the credentials file and network calls during the first run.
SkillSpector findings are pending for this release.