Security audit
Security checks for vulnerabilities and agentic risk
The skill coherently documents a hosted data service and webhook receiver, with disclosed credential use, storage, and security limitations.
Protect the API key and webhook URLs, and consider service charges and provider retention before sending sensitive queries or events. Treat webhook deliveries as unverified notifications; independently confirm events before financial or account actions. The hosted backend and optional MCP implementation were not audited.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
curl -s https://api.superagnt.com/v1/credits \
-H 'Authorization: Bearer $SUPERAGNT_API_KEY'
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
curl -X GET 'https://api.superagnt.com/v1/data/linkedin/get-company-details?username=microsoft' \
-H 'Authorization: Bearer $SUPERAGNT_API_KEY'
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
| Method | Path | Summary |
|--------|------|---------|
| `POST` | `/v1/webhook-endpoints` | Create a new superagnt webhook endpoint. Returns { id, name, url } where `url` is a public HTTPS endpoint of the form https://api.superagnt.com/webhooks/ingest/<id>. Give that URL to a third party (Stripe, Calendly, GitHub, your own service, etc.) so they can POST events to it. superagnt stores every inbound POST as a "delivery" the agent can later fetch with superagnt_webhooks_list_deliveries. The `name` is a workspace-unique label (3-50 chars, lowercase + hyphens) that you can show to the user; it is NOT part of the receive URL. Use this when the user asks to "set up a webhook", "give me a URL to receive events", or "let me ingest events from <vendor>". |
| `GET` | `/v1/webhook-endpoints` | List every active webhook endpoint in the workspace. Returns an array of { id, name, description, isActive, createdAt, updatedAt }. Use the `id` from any item as `endpointId` for superagnt_webhooks_get_en
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
| Get full details of a single webhook endpoint by id. Returns { id, name, description, isActive, createdAt, updatedAt }. Use this when you have an endpoint id (e.g. from superagnt_webhooks_list_endpoints) and need its full record. Note: this does NOT return the receive URL — reconstruct it as https://api.superagnt.com/webhooks/ingest/{id} if you need to show it again. |
| `DELETE` | `/v1/webhook-endpoints/{id}` | Soft-delete (deactivate) a webhook endpoint by id. After deletion the receive URL https://api.superagnt.com/webhooks/ingest/{id} stops accepting POSTs (returns 404). Existing delivery history is retained and still queryable. Use this when the user wants to stop receiving events on an endpoint or rotate to a new one. ALWAYS confirm with the user before deleting — third parties posting to the URL will start failing immediately. |
| `GET` | `/v1/webhook-endpoints/deliveries` | Fetch the most recent webhook deliveries for the workspace, newest first. This is THE tool to use to "c
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
[
{
"name": "superagnt_webhooks_create_endpoint",
"description": "Create a new superagnt webhook endpoint. Returns { id, name, url } where `url` is a public HTTPS endpoint of the form https://api.superagnt.com/webhooks/ingest/<id>. Give that URL to a third party (Stripe, Calendly, GitHub, your own service, etc.) so they can POST events to it. superagnt stores every inbound POST as a \"delivery\" the agent can later fetch with superagnt_webhooks_list_deliveries. The `name` is a workspace-unique label (3-50 chars, lowercase + hyphens) that you can show to the user; it is NOT part of the receive URL. Use this when the user asks to \"set up a webhook\", \"give me a URL to receive events\", or \"let me ingest events from <vendor>\".",
"method": "POST",
"path": "/v1/webhook-endpoints",
"parameters": {
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
},
{
"name": "superagnt_webhooks_delete_endpoint",
"description": "Soft-delete (deactivate) a webhook endpoint by id. After deletion the receive URL https://api.superagnt.com/webhooks/ingest/{id} stops accepting POSTs (returns 404). Existing delivery history is retained and still queryable. Use this when the user wants to stop receiving events on an endpoint or rotate to a new one. ALWAYS confirm with the user before deleting — third parties posting to the URL will start failing immediately.",
"method": "DELETE",
"path": "/v1/webhook-endpoints/{id}",
"parameters": {
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Poll for new deliveries on that endpoint:
curl "https://api.superagnt.com/v1/webhook-endpoints/deliveries?unacknowledged=true&endpointId=%24ENDPOINT_ID&limit=50" \
-H "Authorization: Bearer $SUPERAGNT_API_KEY"
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Acknowledge a batch after processing:
curl -X POST https://api.superagnt.com/v1/webhook-endpoints/deliveries/ack \
-H "Authorization: Bearer $SUPERAGNT_API_KEY" \
-H "Content-Type: application/json" \
-d '{"ids": ["delivery-uuid-1", "delivery-uuid-2"]}'
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
# LinkedIn API Reference
**App name:** `linkedin`
**Base URL:** `https://api.superagnt.com/v1/data/linkedin`
**Endpoints:** 52
Enrich companies and profiles in real time. Designed for agents that need reliable structured data without managing dozens of vendor accounts.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
curl -X GET "https://api.superagnt.com/v1/data/linkedin/get-company-by-domain?param=value" \
-H "Authorization: Bearer $SUPERAGNT_API_KEY"
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
# SEO API Reference
**App name:** `seo`
**Base URL:** `https://api.superagnt.com/v1/data/seo`
**Endpoints:** 22
Live Google results, keyword research, competitor and backlink gaps, page audits and AI answer visibility, all as agent tools.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
curl -X POST "https://api.superagnt.com/v1/data/seo/serp" \
-H "Authorization: Bearer $SUPERAGNT_API_KEY" \
-H "Content-Type: application/json" \
-d '{"key": "value"}'
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
# Web API Reference
**App name:** `web`
**Base URL:** `https://api.superagnt.com/v1/data/web`
**Endpoints:** 3
Scrape any page as clean markdown or structured JSON, search the web and get full page content in one call, and map a site's URLs. Designed for LLMs and automation.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
curl -X POST "https://api.superagnt.com/v1/data/web/scrape" \
-H "Authorization: Bearer $SUPERAGNT_API_KEY" \
-H "Content-Type: application/json" \
-d '{"key": "value"}'
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
# X (Twitter) API Reference
**App name:** `x`
**Base URL:** `https://api.superagnt.com/v1/data/x`
**Endpoints:** 52
Unified access to tweets, user profiles, followers, search, and hashtag streams. Built for LLMs and automation — not one-off scraping.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
curl -X GET "https://api.superagnt.com/v1/data/x/user/medias/continuation?param=value" \
-H "Authorization: Bearer $SUPERAGNT_API_KEY"
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
# YouTube API Reference
**App name:** `youtube`
**Base URL:** `https://api.superagnt.com/v1/data/youtube`
**Endpoints:** 24
Unified access to video metadata, channel discovery, comments, subtitles, and recommendations. Built for LLMs and automation — not one-off scraping.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
curl -X GET "https://api.superagnt.com/v1/data/youtube/video/screenshot?param=value" \
-H "Authorization: Bearer $SUPERAGNT_API_KEY"
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Public, no key required:
curl https://api.superagnt.com/v1/platforms # all platforms: slug, name, endpoints
curl https://api.superagnt.com/v1/platforms/{slug} # one platform: full endpoint list + spec
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
curl https://api.superagnt.com/v1/platforms # all platforms: slug, name, endpoints
curl https://api.superagnt.com/v1/platforms/{slug} # one platform: full endpoint list + spec
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
https://api.superagnt.com/v1/data/{platform}
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Create an endpoint:
curl -X POST https://api.superagnt.com/v1/webhook-endpoints \
-H "Authorization: Bearer $SUPERAGNT_API_KEY" \
-H "Content-Type: application/json" \
-d '{"name": "stripe-prod", "description": "Stripe events for production"}'
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
# Facebook API Reference
**App name:** `facebook`
**Base URL:** `https://api.superagnt.com/v1/data/facebook`
**Endpoints:** 35
Unified access to page and group posts, marketplace listings, video content, and ad discovery. Built for LLMs and automation — not one-off scraping.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
curl -X GET "https://api.superagnt.com/v1/data/facebook/get_facebook_video_post_details?param=value" \
-H "Authorization: Bearer $SUPERAGNT_API_KEY"
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
# Instagram API Reference
**App name:** `instagram`
**Base URL:** `https://api.superagnt.com/v1/data/instagram`
**Endpoints:** 22
Unified access to user profiles, reels, explore, locations, and hashtag media. Built for LLMs and automation — not one-off scraping.