Environment variable access combined with network send.
Critical
- Code
- suspicious.env_credential_access
- Location
- index.js:11
- Evidence
const BASE_URL = (process.env.SUPERAGNT_API_URL || 'https://api.superagnt.com') + '/v1/data/reddit'
Security audit
Reddit Data
Security checks for vulnerabilities and agentic risk
Overview
The plugin provides a fixed set of Reddit lookup tools using disclosed superagnt credentials, with no unrelated or destructive behavior found.
Requests go through superagnt and may consume paid credits. The plugin can reuse your saved superagnt API key. Leave SUPERAGNT_API_URL unset unless you trust the alternate server to receive that key.
SkillSpector was not run because this plugin release contains no bundled skills.
Static analysis
Detected: suspicious.env_credential_access