Security audit
Security checks for vulnerabilities and agentic risk
The skill provides a proportionate Reddit research workflow through LurkAPI, with an unrelated TikTok example and ordinary query-privacy considerations.
LurkAPI receives your search wording and consumes API credits, so omit confidential details and check current charges. Keep the key in your environment and skip the unrelated TikTok example. The review covers the bundled instructions; linked endpoint documentation and live service behavior remain unverified.
The supplied command accesses TikTok profile data, an inconsistent resource and materially different operation from the declared Reddit voice-of-customer research. No Reddit search, thread or comment retrieval, or opinion analysis is shown. The API key is an authentication implementation detail, not a separate mismatch.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Without MCP (Codex, Cursor, scripts), every tool is GET https://api.lurkapi.com plus its path, with the same params as a query string (URL-encoded) and the key from LURKAPI_API_KEY in the x-api-key header:
curl -s "https://api.lurkapi.com/v1/tiktok/profile?handle=nike" -H "x-api-key: $LURKAPI_API_KEY"
If LURKAPI_API_KEY isn't set but LURKAPI_KEY is (the name older docs used), use that. Raw answers are big: pipe them through jq to keep the fields you need. No key yet? Ask the user to create one at https://lurkapi.com/dashboard (100 free credits on sign-up, then a balance below 25 tops back up to 25 every day) and to set LURKAPI_API_KEY in their shell. Never ask for the key in the chat, and never print it.
The search steps instruct the agent to submit the user's topic and problem wording to LurkAPI, a third-party service. Although the API connection is documented, the skill does not warn that these queries disclose user-provided information, potentially including confidential product or competitor research.