Security audit
Security checks for vulnerabilities and agentic risk
This skill is a disclosed Rumoro API helper for social listening, with expected external API use and remote account changes that are aligned with its purpose.
Install this only if you want an agent to use Rumoro and send relevant brand, competitor, keyword, alert, and triage data to Rumoro's API. Prefer a read-only API key for analysis-only work, and use a write key only when you intend the agent to create tracking keywords, alerts, channels, notes, or other account changes that may affect billing.
The skill's activation text is broad enough to trigger on common requests about products, competitors, or public opinion, which can cause the agent to invoke this skill in many ordinary conversations. That increases the chance of unnecessary external API calls and disclosure of user-provided business context to a third-party service without sufficiently explicit user intent.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Rumoro finds public posts that mention the words a company cares about, scores each one for relevance, sentiment and intent, and serves them through a REST API. This skill calls that API with curl.
- Base URL: `https://api.rumoro.dev/v1`
- Every request sends `Authorization: Bearer $RUMORO_API_KEY`
- Full agent guide: `https://mcp.rumoro.dev/mcp/guide`. Read it before the first write in a session.
- Every operation, field and error: `https://api.rumoro.dev/v1/openapi.json`
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Rumoro finds public posts that mention the words a company cares about, scores each one for relevance, sentiment and intent, and serves them through a REST API. This skill calls that API with curl.
- Base URL: `https://api.rumoro.dev/v1`
- Every request sends `Authorization: Bearer $RUMORO_API_KEY`
- Full agent guide: `https://mcp.rumoro.dev/mcp/guide`. Read it before the first write in a session.
- Every operation, field and error: `https://api.rumoro.dev/v1/openapi.json`
The example performs authenticated requests to an external API and therefore creates a concrete egress channel for user-derived search terms and operational metadata. Because the skill is designed for social listening, the transmitted content may include sensitive internal brand-monitoring interests or competitor-tracking activity.
Reads take query parameters. Writes send JSON.
curl -sS "https://api.rumoro.dev/v1/mentions?relevant=true&since=2026-10-01T00:00:00Z&limit=20" \
-H "Authorization: Bearer $RUMORO_API_KEY"
curl -sS -X POST "https://api.rumoro.dev/v1/keywords" \
The example performs authenticated requests to an external API and therefore creates a concrete egress channel for user-derived search terms and operational metadata. Because the skill is designed for social listening, the transmitted content may include sensitive internal brand-monitoring interests or competitor-tracking activity.
Reads take query parameters. Writes send JSON.
curl -sS "https://api.rumoro.dev/v1/mentions?relevant=true&since=2026-10-01T00:00:00Z&limit=20" \
-H "Authorization: Bearer $RUMORO_API_KEY"
curl -sS -X POST "https://api.rumoro.dev/v1/keywords" \
This example shows a state-changing POST request using a bearer token to create tracked keywords on an external service. Because it can modify remote state and incur billing, accidental or over-broad invocation could create unauthorized resources, leak strategic topics, and generate cost for the user.
curl -sS "https://api.rumoro.dev/v1/mentions?relevant=true&since=2026-10-01T00:00:00Z&limit=20"
-H "Authorization: Bearer $RUMORO_API_KEY"
curl -sS -X POST "https://api.rumoro.dev/v1/keywords"
-H "Authorization: Bearer $RUMORO_API_KEY" -H "Content-Type: application/json"
-d '{"term": "driftwood", "kind": "brand"}'
No suspicious patterns detected.