G2 Software Reviews API - Product Search, Ratings, Reviews

• Outcome: Review
• Latest audit: Oct 11, 2026 · 1:48 PM UTC
• Version: 1.0.5

Overview

This skill is a clearly disclosed Scavio/G2 API helper, and its external API calls and API-key use match its stated purpose.

Before installing, understand that using this skill sends G2 search terms, product IDs or G2 URLs, and review filters to Scavio using your SCAVIO_API_KEY, and each G2 request is documented as costing 5 credits. The signup section has one inconsistent sentence saying endpoints cost 1 credit unless stated otherwise, so treat the repeated G2-specific 5-credit warnings as the operative guidance.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (4)

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 70% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 156)May include surrounding context.

md

HEADERS = {"Authorization": f"Bearer {API_KEY}"}

# 1. Find products - 5 credits
found = requests.post(f"{BASE}/api/v1/g2/search", headers=HEADERS,
    json={"query": "project management", "limit": 100, "sort": "rating", "rating": 4}).json()

# 2. Full profile - 5 credits. Slug or numeric id, both as strings.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 70% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 160)May include surrounding context.

md

json={"query": "project management", "limit": 100, "sort": "rating", "rating": 4}).json()

# 2. Full profile - 5 credits. Slug or numeric id, both as strings.
profile = requests.post(f"{BASE}/api/v1/g2/product", headers=HEADERS,
    json={"product_id": "notion"}).json()

# NOTE: profile contains NO review text. For that you must call /reviews.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 70% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 166)May include surrounding context.

md

# NOTE: profile contains NO review text. For that you must call /reviews.

# 3. What enterprise admins say - 5 credits, 10 reviews, plus every facet count
reviews = requests.post(f"{BASE}/api/v1/g2/reviews", headers=HEADERS,
    json={"product_id": "notion", "company_size": "enterprise",
          "role": "administrator", "sort": "newest", "page": 1}).json()

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 70% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 171)May include surrounding context.

md

# NOTE: profile contains NO review text. For that you must call /reviews.

# 3. What enterprise admins say - 5 credits, 10 reviews, plus every facet count
reviews = requests.post(f"{BASE}/api/v1/g2/reviews", headers=HEADERS,
    json={"product_id": "notion", "company_size": "enterprise",
          "role": "administrator", "sort": "newest", "page": 1}).json()

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: SKILL.md:42