Security audit
social-sentiment-monitor
Security checks for vulnerabilities and agentic risk
Overview
The skill mostly does what it says (social sentiment monitoring) but contains inconsistent declarations and an embedded billing integration with a hard-coded API key and undeclared env var requirements — this mismatch and unexpected payment behavior are concerning.
This skill contains reasonable code for sentiment monitoring, but there are important red flags you should address before installing or running it: 1) Billing: the package includes a SkillPay billing integration and a hard-coded API key — confirm who controls that key and how payments are enforced. Do not run code that can charge you without clear, verifiable billing controls. 2) Undeclared env vars: the registry shows no required env vars, yet the scripts expect many API keys (Twitter, Reddit, LunarCrush, Santiment) and notification tokens (Telegram/Discord). Verify and provide keys yourself; do not copy keys into code. 3) Principle of least privilege: run the code in a sandboxed environment (non-root) until you verify behavior; check network calls the first time (eg with outbound traffic monitoring). 4) Remove or rotate any exposed secrets: if you or your organization used the included hard-coded key, assume it is compromised. 5) Ask the publisher for clarification: request why payment is enforced, whether the billing key is intentional, and why required env vars are omitted from registry metadata. If you cannot get satisfactory answers, do not install/run the skill in production or on machines with sensitive data.
Static analysis
No suspicious patterns detected.