Security audit
Security checks for vulnerabilities and agentic risk
This skill provides eBay research through a disclosed third-party API, with expected authentication and credit costs.
Use a Scavio-specific key stored in your environment or secret store. Scavio receives your searches and requested listing or seller identifiers, and requests consume credits. This review covers the supplied instructions, not the provider's internal data handling or live API behavior.
Setting an API-key environment variable could support the declared service, but the supplied chunk contains no implementation or invocation of its advertised capabilities. The mismatch is missing declared functionality, not an undeclared or malicious action. Additional code could change this assessment.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
HEADERS = {"Authorization": f"Bearer {API_KEY}"}
# 1. Price research: used asks, with demand signals on every row
used = requests.post(f"{BASE}/api/v1/ebay/search", headers=HEADERS,
json={"query": "nintendo switch oled", "condition": "used"}).json()
for row in used["data"]["products"]:
print(row["price"], row["sold_count"], row["watchers"], row["bids"], row["url"])
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
print(row["price"], row["sold_count"], row["watchers"], row["bids"], row["url"])
# 2. Live listings, cheapest first, 120 per page
live = requests.post(f"{BASE}/api/v1/ebay/search", headers=HEADERS,
json={"query": "nintendo switch oled", "sort_by": "price_low", "per_page": 120}).json()
# 3. One listing in full
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
json={"item_id": "168591664725"}).json()
# 4. A seller's whole catalogue: /search with seller and no query
catalogue = requests.post(f"{BASE}/api/v1/ebay/search", headers=HEADERS,
json={"seller": "red-rock-uk", "page": 1}).json()
# 5. That seller's reputation card
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
json={"query": "nintendo switch oled", "sort_by": "price_low", "per_page": 120}).json()
# 3. One listing in full
item = requests.post(f"{BASE}/api/v1/ebay/product", headers=HEADERS,
json={"item_id": "168591664725"}).json()
# 4. A seller's whole catalogue: /search with seller and no query
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
json={"seller": "red-rock-uk", "page": 1}).json()
profile = requests.post(f"{BASE}/api/v1/ebay/seller", headers=HEADERS, json={"seller": "red-rock-uk"}).json()