Environment variable access combined with network send.
Critical
- Code
- suspicious.env_credential_access
- Location
- index.js:11
- Evidence
const BASE_URL = (process.env.SUPERAGNT_API_URL || 'https://api.superagnt.com') + '/v1/data/facebook'
Security audit
Facebook Data
Security checks for vulnerabilities and agentic risk
Overview
The plugin provides the advertised Facebook data tools with disclosed authentication and no hidden installation or background actions.
Queries and supplied URLs are sent to superagnt and may consume paid credits. The plugin can reuse your locally saved superagnt key. Leave SUPERAGNT_API_URL unset unless you trust the alternate server, which would receive that key.
SkillSpector was not run because this plugin release contains no bundled skills.
Static analysis
Detected: suspicious.env_credential_access