Security audit
Security checks for vulnerabilities and agentic risk
This skill is a disclosed WorthClip API helper that sends YouTube video/feed/usage requests using the user's WorthClip API key, with no evidence of hidden persistence, unrelated data access, or destructive behavior.
Install only if you intend to use WorthClip's hosted service and are comfortable sending YouTube video IDs plus authenticated feed and usage requests to its Convex backend. Verify the WorthClip developer page before setting your API key, and treat WORTHCLIP_API_KEY like any other service credential.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
PAYLOAD=$(jq -n --arg vid "$VIDEO_ID" '{"youtubeVideoId": $vid}')
# Submit scoring request
RESPONSE=$(curl -s -w "\n%{http_code}" \
-X POST "$BASE/score" \
-H "Authorization: Bearer $API_KEY" \
-H "Content-Type: application/json" \
This shell script sends the provided video identifier to a remote API and includes a bearer token from an environment variable in the request headers. While the script prints progress messages, it does not clearly disclose to the user that input data is being transmitted off-system and that an API credential is being used for the operation.
This shell script reads a credential from the WORTHCLIP_API_KEY environment variable and sends it in an Authorization header during a curl request. Although the behavior is visible in code, there is no user-facing warning, prompt, or descriptive comment indicating that the script will use a sensitive credential to contact a remote service.
The script reads the sensitive environment variable WORTHCLIP_API_KEY, but provides no comment, docstring, or user-facing message explaining that a credential is required and will be used for authentication. For code files, sensitive credential access should have some visible disclosure unless clearly communicated elsewhere.
The script performs an HTTP request and transmits the bearer token in an Authorization header, but there is no confirmation prompt, comment, or user-facing output warning that credentials are being sent to a remote service. This is a safety-relevant network operation and the script itself gives no disclosure beyond the raw command.
No suspicious patterns detected.