Environment variable access combined with network send.
Critical
- Code
- suspicious.env_credential_access
- Location
- index.js:11
- Evidence
const BASE_URL = (process.env.SUPERAGNT_API_URL || 'https://api.superagnt.com') + '/v1/data/youtube'
Security audit
YouTube Data
Security checks for vulnerabilities and agentic risk
Overview
The plugin provides a fixed set of YouTube data tools with disclosed API authentication and no hidden background activity.
Requests share your search terms and resource identifiers with superagnt and may consume paid credits. Protect your API key, use channel email results appropriately, and leave SUPERAGNT_API_URL unset unless you trust the replacement server.
SkillSpector was not run because this plugin release contains no bundled skills.
Static analysis
Detected: suspicious.env_credential_access