Security audit
Security checks for vulnerabilities and agentic risk
This skill is a disclosed LinkDigest client for summarizing user-provided video links, with no evidence of hidden local access, persistence, or destructive behavior.
Install only if you are comfortable sending video or social-media links to linkdigest.dev with your LinkDigest API key. Use --max-credits when cost matters, and do not submit private or sensitive links unless you accept the service's remote processing and link-based result caching.
The skill requires environment access, shell execution, and outbound network access but does not declare any explicit tool scope such as permissions or allowed-tools. That makes the effective privilege boundary unclear and can allow broader execution or data egress than reviewers or users expect, especially because the skill handles an API key and invokes curl/python against a remote service.
The manifest describes a YouTube-specific summary/transcript skill, but the inline CLI description says the tool reads links from multiple unrelated platforms such as 小红书、抖音、TikTok、X and 公众号文章. This is not just incomplete documentation; it affirmatively describes a broader intent than the declared skill purpose.
No suspicious patterns detected.
