Security audit
Security checks for vulnerabilities and agentic risk
ClawScan rates this skill suspicious because scanners report financial and partner administration capabilities beyond its stated link and analytics purpose; the evidence is incomplete.
Consider not installing until you can verify that the financial and partner administration capabilities are necessary and intended. Skillspector's analysis is partial because it could not resolve several local references, so the available evidence is incomplete; the suspicious verdict indicates concerns, not proof of malicious intent.
The supplied code only requests the credits endpoint and contains no link management, conversion tracking, or attribution analytics operations. In this standalone chunk, credit retrieval is a materially different purpose, with no demonstrated supporting role in the declared functionality.
The manifest at L0003 describes managing short links, tracking conversions, and reading attribution analytics. However, L1421-L1438 and L1448-L1469 expose bounty approval/rejection and custom reward amounts, while L1562-L1591 expose commission earnings, sale-amount, and status changes that can recalculate payouts. These are financial program administration operations, not merely conversion tracking or attribution reporting.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
curl -s https://api.superagnt.com/v1/credits \
-H 'Authorization: Bearer $SUPERAGNT_API_KEY'
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
https://api.superagnt.com/v1/connections/dub
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
curl -X GET 'https://api.superagnt.com/v1/connections/dub/links&; \
-H 'Authorization: Bearer $SUPERAGNT_API_KEY'
L1330-L1373 expose POST operations to ban and deactivate partners. Managing partner short links can support the declared purpose, but changing a partner's participation status is a separate administrative capability that is not necessary to manage links, record conversions, or read attribution analytics.