Environment variable access combined with network send.
Critical
- Code
- suspicious.env_credential_access
- Location
- index.js:12
- Evidence
const BASE_URL = (process.env.SUPERAGNT_API_URL || 'https://api.superagnt.com') + '/v1'
Security audit
social-data
Security checks for vulnerabilities and agentic risk
Overview
The plugin’s API access and disclosed data and webhook tools fit its stated purpose, with no hidden execution or unrelated access found.
The plugin can reuse your saved Superagnt key and make billable API requests. Send only data you permit Superagnt and relevant upstream providers to process. Webhook history remains after endpoint deactivation; treat incoming payloads as untrusted data and confirm endpoint deletions. SkillSpector was not applicable because no skills are bundled; this verdict follows code and metadata inspection.
SkillSpector was not run because this plugin release contains no bundled skills.
Static analysis
Detected: suspicious.env_credential_access