Security audit
Security checks for vulnerabilities and agentic risk
This skill is a straightforward guide for using Doubleword batch inference, with clear user-directed API uploads but limited privacy guidance.
Install only if you intend to use Doubleword's external API. Review batch JSONL files before upload, avoid secrets and regulated or confidential data unless approved for Doubleword processing, protect downloaded results and error files, and manage the DOUBLEWORD_API_KEY like any other API credential.
The skill instructs users to upload batch request files and later download result files from a third-party service without any warning about sensitive data handling, retention, or privacy implications. Because batch payloads may contain prompts, user content, or identifiers, this omission can lead to unintended disclosure of regulated or confidential information to an external processor.
This step explicitly uploads a local JSONL file to an external API endpoint, which is a real data exfiltration boundary. While external transmission is expected for this skill's purpose, the lack of guardrails about what may be included in the batch file makes accidental disclosure of sensitive data plausible.
Upload the JSONL file:
curl https://api.doubleword.ai/v1/files \
-H "Authorization: Bearer $DOUBLEWORD_API_KEY" \
-F purpose="batch" \
-F file="@batch_requests.jsonl"
This step explicitly uploads a local JSONL file to an external API endpoint, which is a real data exfiltration boundary. While external transmission is expected for this skill's purpose, the lack of guardrails about what may be included in the batch file makes accidental disclosure of sensitive data plausible.
Upload the JSONL file:
curl https://api.doubleword.ai/v1/files \
-H "Authorization: Bearer $DOUBLEWORD_API_KEY" \
-F purpose="batch" \
-F file="@batch_requests.jsonl"
Downloading completed results from the external provider can return model outputs that may still contain sensitive inputs, derived personal data, or confidential content. Without guidance on secure storage, review, and disposal of downloaded results, users may mishandle externally processed data on local systems.
Download completed results:
curl https://api.doubleword.ai/v1/files/file-output123/content \
-H "Authorization: Bearer $DOUBLEWORD_API_KEY" \
> results.jsonl
The error file download may include fragments of failed requests, identifiers, or validation details that reveal sensitive input structure or data. Treating error artifacts as harmless can lead to leakage through logs, shared files, or unsecured workstations.
Download errors (if any):
curl https://api.doubleword.ai/v1/files/file-error123/content \
-H "Authorization: Bearer $DOUBLEWORD_API_KEY" \
> errors.jsonl
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
https://api.doubleword.ai/v1
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
https://api.doubleword.ai/v1
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
https://api.doubleword.ai/v1
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
https://api.doubleword.ai/v1
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
https://api.doubleword.ai/v1
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
https://api.doubleword.ai/v1
This markdown file documents file upload and result retrieval endpoints that can transmit user prompts and outputs to a remote service, but it provides no user-facing warning about privacy or data-sensitivity considerations. Under the markdown-specific warning criteria, documentation should mention behaviors that could affect user data or privacy when those behaviors are central to the skill.
No suspicious patterns detected.