Environment variable access combined with network send.
Critical
- Code
- suspicious.env_credential_access
- Location
- index.js:11
- Evidence
const BASE_URL = (process.env.SUPERAGNT_API_URL || 'https://api.superagnt.com') + '/v1/data/tiktok'
Security audit
TikTok Data
Security checks for vulnerabilities and agentic risk
Overview
The plugin’s fixed TikTok lookup and search tools match its stated purpose, with proportionate credential use and no hidden background activity.
Tool calls send lookup parameters and your API key to superagnt and may consume paid credits. The plugin can reuse your saved superagnt key. Leave SUPERAGNT_API_URL unset unless you trust the alternate destination.
SkillSpector was not run because this plugin release contains no bundled skills.
Static analysis
Detected: suspicious.env_credential_access