Dick's Sporting Goods API - Clearance, Per-Size Prices, Store Stock

• Outcome: Pass
• Latest audit: Nov 11, 2026 · 3:18 AM UTC
• Version: 1.0.0

Overview

ClawScan rates this skill benign with medium overall confidence: its findings are considered consistent with its stated shopping API purpose, with a privacy notice gap and incomplete reference checks to keep in mind.

Before installing, consider that store availability lookups share your ZIP code and selected products with Scavio, and the scanner noted there is no privacy warning for this. The skill scan was partial: it inspected the one reported component, but unresolved local references mean the evidence is incomplete. The verdict is benign, not risk-free.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Output Handling: Unvalidated Output Injection, Cross-Context Output, Unbounded Output
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (12)

The store-stock workflow sends the user's ZIP code to Scavio without a privacy warning.

Medium

• Category: Output Handling
• Confidence: 93% confidence

Finding

Step 5 instructs the agent to submit the user's ZIP code together with selected product SKUs to the third-party Scavio API. Although the API host and parameters are documented, the skill does not warn users that their location and associated shopping interests will be shared with Scavio; the privacy guardrail at L904 addresses only reviewer data.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 175)May include surrounding context.

Product

bash

curl -X POST https://api.scavio.dev/api/v1/dicks/product \
  -H "Authorization: Bearer $SCAVIO_API_KEY" \
  -H "Content-Type: application/json" \
  --max-time 180 \

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 175)May include surrounding context.

Product

bash

curl -X POST https://api.scavio.dev/api/v1/dicks/product \
  -H "Authorization: Bearer $SCAVIO_API_KEY" \
  -H "Content-Type: application/json" \
  --max-time 180 \

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 280)May include surrounding context.

Products (batch)

bash

curl -X POST https://api.scavio.dev/api/v1/dicks/products \
  -H "Authorization: Bearer $SCAVIO_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"product_ids": ["23FHQMCLFTN9GTXBLMNS", "26UNDMFITN1HRI9WUAETC", "17YETARMBLR20WMGSODR"]}'

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 329)May include surrounding context.

Deals (clearance)

bash

curl -X POST https://api.scavio.dev/api/v1/dicks/deals \
  -H "Authorization: Bearer $SCAVIO_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"type": "clearance"}'

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 511)May include surrounding context.

Category

bash

curl -X POST https://api.scavio.dev/api/v1/dicks/category \
  -H "Authorization: Bearer $SCAVIO_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"path": "/f/mens-running-shoes"}'

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 582)May include surrounding context.

Brand

bash

curl -X POST https://api.scavio.dev/api/v1/dicks/brand \
  -H "Authorization: Bearer $SCAVIO_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"brand": "YETI"}'

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 696)May include surrounding context.

Reviews

bash

curl -X POST https://api.scavio.dev/api/v1/dicks/reviews \
  -H "Authorization: Bearer $SCAVIO_API_KEY" \
  -H "Content-Type: application/json" \
  --max-time 180 \

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 410)May include surrounding context.

Search

bash

curl -X POST https://api.scavio.dev/api/v1/dicks/search \
  -H "Authorization: Bearer $SCAVIO_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"query": "running shoes"}'

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 779)May include surrounding context.

Suggestions

bash

curl -X POST https://api.scavio.dev/api/v1/dicks/suggestions \
  -H "Authorization: Bearer $SCAVIO_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"query": "yeti tum"}'

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 609)May include surrounding context.

Store availability

bash

curl -X POST https://api.scavio.dev/api/v1/dicks/store-availability \
  -H "Authorization: Bearer $SCAVIO_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"skus": ["25535758", "26810079"], "zip": "60601"}'

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 70% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 842)May include surrounding context.

md

HEADERS = {"Authorization": f"Bearer {API_KEY}"}

def dicks(endpoint, body, timeout=90):
    r = requests.post(f"{BASE}/api/v1/dicks/{endpoint}", headers=HEADERS, json=body, timeout=timeout)
    r.raise_for_status()
    return r.json()["data"]