Security audit
Security checks for vulnerabilities and agentic risk
This skill coherently sends a user-provided public social-media link to LinkDigest for paid extraction and translation, with the main privacy and cost implications disclosed.
Install only if you are comfortable sending the public link or copied share text to linkdigest.dev under your LinkDigest API key. Use --max-credits for budget control, avoid private or sensitive links because results may be cached by link, and treat translations, OCR, summaries, and model-written key points as service output to verify against originals.
The skill requires access to an API key, shell execution, and outbound network access, but it does not declare an explicit tool scope or allowed-tools policy. That increases the attack surface because a host agent may grant broader capabilities than necessary, making misuse of the API key or arbitrary command execution more likely if the skill is invoked in an unexpected context.
The manifest says this skill is for reading Xiaohongshu/RedNote and Douyin links, but the code's own CLI description and help text explicitly support TikTok, YouTube, X, and WeChat articles. That means the implemented behavior is materially broader than the advertised scope.
No suspicious patterns detected.
