Security audit
Security checks for vulnerabilities and agentic risk
This skill sends user-provided video links to LinkDigest for transcription and is transparent about its API key, network use, costs, caching, and privacy limits.
Install only if you are comfortable sending submitted video links and the optional LinkDigest API key to linkdigest.dev. Avoid submitting private links because text results may be cached by link, and pin or review mcp-remote before using the optional npx MCP setup.
The skill invokes shell commands, reads an environment variable containing an API key, and performs network requests, but it does not declare an explicit tool scope or permissions boundary. That creates unnecessary ambiguity for the host/agent about what the skill is allowed to access, increasing the risk of overbroad execution or unsafe approval decisions.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
curl -sS -X POST https://linkdigest.dev/api/v1/digest \
-H "Authorization: Bearer $LINKDIGEST_API_KEY" \
-H "Content-Type: application/json" \
-d '{"url": "https://v.douyin.com/<短链>/", "format": "json"}'
The skill recommends running npx mcp-remote without pinning a specific version. This exposes users to supply-chain risk because a future or compromised package release could execute arbitrary code at install/run time with the user's privileges and access to the provided bearer token.
No suspicious patterns detected.