File appears to expose a hardcoded API secret or token.
Critical
- Code
- suspicious.exposed_secret_literal
- Location
- skills/scavio-airbnb/SKILL.md:37
- Evidence
export SCAVIO_API_KEY=[REDACTED]
Security audit
Scavio
Security checks across malware telemetry and agentic risk
Overview
This is a disclosed Scavio web-data skill bundle that uses a user-provided API key to query public web/platform data, with no hidden code, persistence, local data access, or destructive behavior found.
Before installing, be comfortable sending the URLs, searches, handles, product IDs, or other requested public-data identifiers to Scavio and spending Scavio credits. Keep the API key secret, prefer the platform allowlist over enabling every tool surface unless needed, and use care when summarizing public personal or social data.
SkillSpector
By NVIDIA
SkillSpector was not run because this plugin release contains no bundled skills.
VirusTotal
65/65 vendors flagged this plugin as clean.
Static analysis
Detected: suspicious.exposed_secret_literal
File appears to expose a hardcoded API secret or token.
Critical
- Code
- suspicious.exposed_secret_literal
- Location
- skills/scavio-amazon/SKILL.md:45
- Evidence
export SCAVIO_API_KEY=[REDACTED]
File appears to expose a hardcoded API secret or token.
Critical
- Code
- suspicious.exposed_secret_literal
- Location
- skills/scavio-app-store/SKILL.md:37
- Evidence
export SCAVIO_API_KEY=[REDACTED]
File appears to expose a hardcoded API secret or token.
Critical
- Code
- suspicious.exposed_secret_literal
- Location
- skills/scavio-booking/SKILL.md:37
- Evidence
export SCAVIO_API_KEY=[REDACTED]
File appears to expose a hardcoded API secret or token.
Critical
- Code
- suspicious.exposed_secret_literal
- Location
- skills/scavio-capterra/SKILL.md:36
- Evidence
export SCAVIO_API_KEY=[REDACTED]
File appears to expose a hardcoded API secret or token.
Critical
- Code
- suspicious.exposed_secret_literal
- Location
- skills/scavio-companies-house/SKILL.md:38
- Evidence
export SCAVIO_API_KEY=[REDACTED]
File appears to expose a hardcoded API secret or token.
Critical
- Code
- suspicious.exposed_secret_literal
- Location
- skills/scavio-ebay/SKILL.md:38
- Evidence
export SCAVIO_API_KEY=[REDACTED]
File appears to expose a hardcoded API secret or token.
Critical
- Code
- suspicious.exposed_secret_literal
- Location
- skills/scavio-extract/SKILL.md:40
- Evidence
export SCAVIO_API_KEY=[REDACTED]
File appears to expose a hardcoded API secret or token.
Critical
- Code
- suspicious.exposed_secret_literal
- Location
- skills/scavio-g2/SKILL.md:42
- Evidence
export SCAVIO_API_KEY=[REDACTED]
File appears to expose a hardcoded API secret or token.
Critical
- Code
- suspicious.exposed_secret_literal
- Location
- skills/scavio-glassdoor/SKILL.md:38
- Evidence
export SCAVIO_API_KEY=[REDACTED]
File appears to expose a hardcoded API secret or token.
Critical
- Code
- suspicious.exposed_secret_literal
- Location
- skills/scavio-google-ads/SKILL.md:37
- Evidence
export SCAVIO_API_KEY=[REDACTED]
File appears to expose a hardcoded API secret or token.
Critical
- Code
- suspicious.exposed_secret_literal
- Location
- skills/scavio-google-ai-mode/SKILL.md:35
- Evidence
export SCAVIO_API_KEY=[REDACTED]
File appears to expose a hardcoded API secret or token.
Critical
- Code
- suspicious.exposed_secret_literal
- Location
- skills/scavio-google-flights/SKILL.md:35
- Evidence
export SCAVIO_API_KEY=[REDACTED]
File appears to expose a hardcoded API secret or token.
Critical
- Code
- suspicious.exposed_secret_literal
- Location
- skills/scavio-google-hotels/SKILL.md:34
- Evidence
export SCAVIO_API_KEY=[REDACTED]
File appears to expose a hardcoded API secret or token.
Critical
- Code
- suspicious.exposed_secret_literal
- Location
- skills/scavio-google-maps/SKILL.md:35
- Evidence
export SCAVIO_API_KEY=[REDACTED]
File appears to expose a hardcoded API secret or token.
Critical
- Code
- suspicious.exposed_secret_literal
- Location
- skills/scavio-google-news/SKILL.md:37
- Evidence
export SCAVIO_API_KEY=[REDACTED]
File appears to expose a hardcoded API secret or token.
Critical
- Code
- suspicious.exposed_secret_literal
- Location
- skills/scavio-google-play/SKILL.md:37
- Evidence
export SCAVIO_API_KEY=[REDACTED]
File appears to expose a hardcoded API secret or token.
Critical
- Code
- suspicious.exposed_secret_literal
- Location
- skills/scavio-google-shopping/SKILL.md:35
- Evidence
export SCAVIO_API_KEY=[REDACTED]
File appears to expose a hardcoded API secret or token.
Critical
- Code
- suspicious.exposed_secret_literal
- Location
- skills/scavio-google-trends/SKILL.md:35
- Evidence
export SCAVIO_API_KEY=[REDACTED]
File appears to expose a hardcoded API secret or token.
Critical
- Code
- suspicious.exposed_secret_literal
- Location
- skills/scavio-google/SKILL.md:37
- Evidence
export SCAVIO_API_KEY=[REDACTED]
File appears to expose a hardcoded API secret or token.
Critical
- Code
- suspicious.exposed_secret_literal
- Location
- skills/scavio-home-depot/SKILL.md:37
- Evidence
export SCAVIO_API_KEY=[REDACTED]
File appears to expose a hardcoded API secret or token.
Critical
- Code
- suspicious.exposed_secret_literal
- Location
- skills/scavio-indeed/SKILL.md:37
- Evidence
export SCAVIO_API_KEY=[REDACTED]
File appears to expose a hardcoded API secret or token.
Critical
- Code
- suspicious.exposed_secret_literal
- Location
- skills/scavio-instagram/SKILL.md:61
- Evidence
export SCAVIO_API_KEY=[REDACTED]
File appears to expose a hardcoded API secret or token.
Critical
- Code
- suspicious.exposed_secret_literal
- Location
- skills/scavio-kuaishou/SKILL.md:43
- Evidence
export SCAVIO_API_KEY=[REDACTED]
File appears to expose a hardcoded API secret or token.
Critical
- Code
- suspicious.exposed_secret_literal
- Location
- skills/scavio-linkedin/SKILL.md:39
- Evidence
export SCAVIO_API_KEY=[REDACTED]
File appears to expose a hardcoded API secret or token.
Critical
- Code
- suspicious.exposed_secret_literal
- Location
- skills/scavio-meta-ads/SKILL.md:47
- Evidence
export SCAVIO_API_KEY=[REDACTED]
File appears to expose a hardcoded API secret or token.
Critical
- Code
- suspicious.exposed_secret_literal
- Location
- skills/scavio-reddit/SKILL.md:42
- Evidence
export SCAVIO_API_KEY=[REDACTED]
File appears to expose a hardcoded API secret or token.
Critical
- Code
- suspicious.exposed_secret_literal
- Location
- skills/scavio-redfin/SKILL.md:36
- Evidence
export SCAVIO_API_KEY=[REDACTED]
File appears to expose a hardcoded API secret or token.
Critical
- Code
- suspicious.exposed_secret_literal
- Location
- skills/scavio-sec-edgar/SKILL.md:38
- Evidence
export SCAVIO_API_KEY=[REDACTED]
File appears to expose a hardcoded API secret or token.
Critical
- Code
- suspicious.exposed_secret_literal
- Location
- skills/scavio-target/SKILL.md:39
- Evidence
export SCAVIO_API_KEY=[REDACTED]
File appears to expose a hardcoded API secret or token.
Critical
- Code
- suspicious.exposed_secret_literal
- Location
- skills/scavio-threads/SKILL.md:42
- Evidence
export SCAVIO_API_KEY=[REDACTED]
File appears to expose a hardcoded API secret or token.
Critical
- Code
- suspicious.exposed_secret_literal
- Location
- skills/scavio-tiktok-shop/SKILL.md:47
- Evidence
export SCAVIO_API_KEY=[REDACTED]
File appears to expose a hardcoded API secret or token.
Critical
- Code
- suspicious.exposed_secret_literal
- Location
- skills/scavio-tiktok/SKILL.md:40
- Evidence
export SCAVIO_API_KEY=[REDACTED]
File appears to expose a hardcoded API secret or token.
Critical
- Code
- suspicious.exposed_secret_literal
- Location
- skills/scavio-tripadvisor/SKILL.md:37
- Evidence
export SCAVIO_API_KEY=[REDACTED]
File appears to expose a hardcoded API secret or token.
Critical
- Code
- suspicious.exposed_secret_literal
- Location
- skills/scavio-walmart/SKILL.md:40
- Evidence
export SCAVIO_API_KEY=[REDACTED]
File appears to expose a hardcoded API secret or token.
Critical
- Code
- suspicious.exposed_secret_literal
- Location
- skills/scavio-x/SKILL.md:39
- Evidence
export SCAVIO_API_KEY=[REDACTED]
File appears to expose a hardcoded API secret or token.
Critical
- Code
- suspicious.exposed_secret_literal
- Location
- skills/scavio-yelp/SKILL.md:36
- Evidence
export SCAVIO_API_KEY=[REDACTED]
File appears to expose a hardcoded API secret or token.
Critical
- Code
- suspicious.exposed_secret_literal
- Location
- skills/scavio-youtube/SKILL.md:38
- Evidence
export SCAVIO_API_KEY=[REDACTED]
File appears to expose a hardcoded API secret or token.
Critical
- Code
- suspicious.exposed_secret_literal
- Location
- skills/scavio-zillow/SKILL.md:37
- Evidence
export SCAVIO_API_KEY=[REDACTED]