Security audit
Security checks for vulnerabilities and agentic risk
This skill wraps a third-party Facebook data API but exposes people, seller, marketplace, and ad-research endpoints beyond its narrow short description, so it needs review before use.
Install only if you intend to use Superagnt as a third-party provider for Facebook-derived research data. Review whether your use of people search, seller details, group content, comments, marketplace listings, and ad data complies with applicable privacy rules, platform terms, and consent expectations; prefer explicit user approval before invoking people or seller endpoints.
The manifest description narrows the skill to pages, posts, and group data, but the body documents broader capabilities including marketplace listings, seller details, ad discovery, and people search. This mismatch can mislead users and policy systems about the actual scope of data access, increasing the chance of unintended collection or approval of higher-risk operations.
The skill facilitates remote collection of Facebook people, group, seller, ad, and marketplace data but does not disclose privacy, consent, or data-use constraints. In practice this makes sensitive data collection easier to normalize and increases the likelihood of misuse or policy noncompliance by downstream agents.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
One call proves the key, the credit balance, and this source end to end:
curl -s https://api.superagnt.com/v1/credits \
-H 'Authorization: Bearer $SUPERAGNT_API_KEY'
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
One call proves the key, the credit balance, and this source end to end:
curl -s https://api.superagnt.com/v1/credits \
-H 'Authorization: Bearer $SUPERAGNT_API_KEY'
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
One call proves the key, the credit balance, and this source end to end:
curl -s https://api.superagnt.com/v1/credits \
-H 'Authorization: Bearer $SUPERAGNT_API_KEY'
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
One call proves the key, the credit balance, and this source end to end:
curl -s https://api.superagnt.com/v1/credits \
-H 'Authorization: Bearer $SUPERAGNT_API_KEY'
People search is materially more privacy-sensitive than page/post/group research and is not clearly justified by the stated business purpose. In an agent setting, this can enable profiling or collection of personal data under the guise of brand research, creating misuse and compliance risk.
The documentation states authentication uses an Authorization Bearer token, but the example later uses X-API-Key. Inconsistent auth guidance can cause integration errors, accidental key exposure through ad hoc troubleshooting, or clients sending secrets in unintended formats.
No suspicious patterns detected.