Security audit
Security checks for vulnerabilities and agentic risk
The skill coherently uses LurkAPI to retrieve and analyze requested video transcripts, with disclosed authentication and credit costs.
LurkAPI receives the video links and creator identifiers you select, and requests consume account credits. Keep your API key out of chat and review batch costs. The bundled instructions were fully reviewed; live service behavior and provider data-retention practices were not verified.
Profile lookup could support discovering a creator's videos, but the supplied code only requests Nike's profile and shows no connection to selecting videos or extracting what they say. Its demonstrated purpose is therefore materially different from the declared workflow. The API request and API-key usage are not independently suspicious.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Without MCP (Codex, Cursor, scripts), every tool is GET https://api.lurkapi.com plus its path, with the same params as a query string (URL-encoded) and the key from LURKAPI_API_KEY in the x-api-key header:
curl -s "https://api.lurkapi.com/v1/tiktok/profile?handle=nike" -H "x-api-key: $LURKAPI_API_KEY"
If LURKAPI_API_KEY isn't set but LURKAPI_KEY is (the name older docs used), use that. Raw answers are big: pipe them through jq to keep the fields you need. No key yet? Ask the user to create one at https://lurkapi.com/dashboard (100 free credits on sign-up, then a balance below 25 tops back up to 25 every day) and to set LURKAPI_API_KEY in their shell. Never ask for the key in the chat, and never print it.
The workflow instructs the agent to submit video URLs and creator handles to LurkAPI for transcription and listing. Although the API integration and credit costs are documented, the skill does not tell users that their supplied links and creator selections will be disclosed to a third-party service.