Security audit
Security checks for vulnerabilities and agentic risk
This skill is a coherent DataFeeds sports API helper that makes disclosed authenticated API calls and does not show hidden persistence, destructive behavior, or unrelated data access.
Install only if you intend to use Rolling Insights DataFeeds. Keep RSC_TOKEN in a local secret or environment variable, do not share raw URLs containing RSC_token, leave the base URL pointed at the official HTTPS API unless you deliberately use a trusted endpoint, and rotate the token if it appears in logs, screenshots, or chat.
The trigger phrase "Use this skill for any DataFeeds by Rolling Insights API question" is overly broad and lacks clear scope boundaries or exclusions. In an agent environment, this can cause the skill to be selected for loosely related requests, increasing the chance of inappropriate tool use, data handling in the wrong context, or bypass of a more specific/safe skill through overmatching.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
TMP_HEADERS="$(mktemp)"
trap 'rm -f "${TMP_BODY}" "${TMP_HEADERS}"' EXIT
if ! curl -sS -D "${TMP_HEADERS}" -o "${TMP_BODY}" \
-H 'Accept: application/json' \
-H 'Cache-Control: no-cache, no-store' \
-H 'Pragma: no-cache' \
The script makes authenticated requests to an external service using a bearer-like token supplied via environment variable, yet the provided skill context does not establish a clear need for outbound authenticated network access. This increases risk because the skill can transmit sensitive data or metadata to a third party, and the token is placed in the URL query string, which is more likely to be exposed in logs, proxies, shell history, or monitoring systems.
The documentation repeatedly places the authentication token in a query parameter (RSC_token=...) and provides no warning about protecting that credential. Query-string tokens are commonly exposed in browser history, logs, proxy records, monitoring tools, and referrer data, so examples like this can normalize insecure handling and lead users to leak live credentials.
Line L007 tells users to append RSC_token to every request, which involves transmitting a credential. The markdown does not include any warning about protecting the token from exposure in logs, shared URLs, or client-side surfaces.
No suspicious patterns detected.