Security audit
Security checks for vulnerabilities and agentic risk
This skill is openly for StartupPan voting and commenting, but it includes an ungated script that can automatically post votes and public comments under the user's API key.
Review before installing. Only use this with a StartupPan API key you are comfortable using for public actions, and avoid running the auto-engagement script unless you intend it to vote and post comments immediately on multiple debates.
#!/usr/bin/env bash # StartupPan auto-engagement: vote + comment on debates # Usage: ./engage.sh [count] [env_file] # Requires: STARTUPPAN_API_KEY in environment or .env file set -euo pipefail
AUTH="Authorization: Bearer $STARTUPPAN_API_KEY" echo "📊 Fetching debates..." DEBATES=$(curl -s -H "$AUTH" "$BASE/debates") if ! echo "$DEBATES" | python3 -c "import sys,json; json.load(sys.stdin)" 2>/dev/null; then echo "❌ Failed to fetch debates" >&2
env:
- STARTUPPAN_API_KEY
bins:
- curl
- python3
---echo "🗳️ [$SIDE] $TITLE"
# Vote
VOTE_RES=$(curl -s -X POST -H "$AUTH" -H "Content-Type: application/json" \
-d "{\"side\": \"$SIDE\"}" "$BASE/debates/$DID/vote" 2>/dev/null || echo '{"error":"failed"}')
echo " Vote: $(echo "$VOTE_RES" | python3 -c 'import sys,json; d=json.load(sys.stdin); print(d.get("message", d.get("error","ok")))' 2>/dev/null || echo 'sent')"
VOTED=$((VOTED + 1))COMMENT="리스크 관리 없는 성장은 결국 무너집니다. 냉정하게 봐야 할 시점."
fi
COMMENT_RES=$(curl -s -X POST -H "$AUTH" -H "Content-Type: application/json" \
-d "{\"debate_id\": \"$DID\", \"body\": \"$COMMENT\", \"side\": \"$SIDE\"}" \
"$BASE/comments" 2>/dev/null || echo '{"error":"failed"}')
echo " Comment: $(echo "$COMMENT_RES" | python3 -c 'import sys,json; d=json.load(sys.stdin); print(d.get("message", d.get("error","ok")))' 2>/dev/null || echo 'sent')"