Security audit
Security checks for vulnerabilities and agentic risk
The skill is rated benign with medium confidence: scanners found no issues in one scan, while another flagged external API requests and missing location privacy notice; findings were considered purpose-related, but coverage was partial.
Before installing, consider that using store lookup may send your postal code to Scavio without a privacy notice. The results are incomplete: Skillspector marked its analysis partial because some local references were missing, and the findings do not establish whether the external service is trustworthy.
The workflow instructs the agent to call the store locator with the shopper's postal code, and the configured API host is the third-party service api.scavio.dev. Although the provider and request parameters are documented, the skill does not warn users that their location information will be transmitted to Scavio.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
curl -X POST https://api.scavio.dev/api/v1/carrefour/search \
-H "Authorization: Bearer $SCAVIO_API_KEY" \
-H "Content-Type: application/json" \
-d '{"query": "nutella"}'
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
curl -X POST https://api.scavio.dev/api/v1/carrefour/search \
-H "Authorization: Bearer $SCAVIO_API_KEY" \
-H "Content-Type: application/json" \
-d '{"query": "nutella"}'
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
curl -X POST https://api.scavio.dev/api/v1/carrefour/product \
-H "Authorization: Bearer $SCAVIO_API_KEY" \
-H "Content-Type: application/json" \
-d '{"ean": "3017620422003"}'
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
curl -X POST https://api.scavio.dev/api/v1/carrefour/reviews \
-H "Authorization: Bearer $SCAVIO_API_KEY" \
-H "Content-Type: application/json" \
-d '{"ean": "8006530256179"}'
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
curl -X POST https://api.scavio.dev/api/v1/carrefour/promotions \
-H "Authorization: Bearer $SCAVIO_API_KEY" \
-H "Content-Type: application/json" \
-d '{"type": "catalogue"}'
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
curl -X POST https://api.scavio.dev/api/v1/carrefour/store \
-H "Authorization: Bearer $SCAVIO_API_KEY" \
-H "Content-Type: application/json" \
-d '{"slug": "venissieux"}'
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
curl -X POST https://api.scavio.dev/api/v1/carrefour/search \
-H "Authorization: Bearer $SCAVIO_API_KEY" \
-H "Content-Type: application/json" \
-d '{"query": "yerba", "country": "ar"}'
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
curl -X POST https://api.scavio.dev/api/v1/carrefour/search \
-H "Authorization: Bearer $SCAVIO_API_KEY" \
-H "Content-Type: application/json" \
-d '{"query": "nutella", "store": "840093"}'
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
curl -X POST https://api.scavio.dev/api/v1/carrefour/suggestions \
-H "Authorization: Bearer $SCAVIO_API_KEY" \
-H "Content-Type: application/json" \
-d '{"query": "nutel"}'
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
curl -X POST https://api.scavio.dev/api/v1/carrefour/stores \
-H "Authorization: Bearer $SCAVIO_API_KEY" \
-H "Content-Type: application/json" \
-d '{"postal_code": "69003"}'
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
curl -X POST https://api.scavio.dev/api/v1/carrefour/store-availability \
-H "Authorization: Bearer $SCAVIO_API_KEY" \
-H "Content-Type: application/json" \
-d '{"ean": "3017620422003", "postal_code": "69003"}'
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
HEADERS = {"Authorization": f"Bearer {API_KEY}"}
def carrefour(endpoint, body, timeout=60):
r = requests.post(f"{BASE}/api/v1/carrefour/{endpoint}", headers=HEADERS, json=body, timeout=timeout)
r.raise_for_status()
return r.json()["data"]