Security audit
Security checks for vulnerabilities and agentic risk
The verdict is benign with medium confidence: the scanners found documented calls to the Scavio IKEA API, while noting a privacy disclosure gap and incomplete coverage.
Before installing, consider whether you are comfortable sending IKEA lookup requests to Scavio. If using home-delivery availability, be aware that the scanner reports the postal code may be shared without a privacy warning. Confidence is medium: Skillspector coverage is partial because some local references could not be resolved, so the evidence is incomplete.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
curl -X POST https://api.scavio.dev/api/v1/ikea/compare \
-H "Authorization: Bearer $SCAVIO_API_KEY" \
-H "Content-Type: application/json" \
-d '{"item_no": "80275887", "countries": ["de", "fr", "se", "nl", "es", "it"]}'
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
curl -X POST https://api.scavio.dev/api/v1/ikea/compare \
-H "Authorization: Bearer $SCAVIO_API_KEY" \
-H "Content-Type: application/json" \
-d '{"item_no": "80275887", "countries": ["de", "fr", "se", "nl", "es", "it"]}'
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
curl -X POST https://api.scavio.dev/api/v1/ikea/search \
-H "Authorization: Bearer $SCAVIO_API_KEY" \
-H "Content-Type: application/json" \
-d '{"query": "kallax"}'
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
curl -X POST https://api.scavio.dev/api/v1/ikea/product \
-H "Authorization: Bearer $SCAVIO_API_KEY" \
-H "Content-Type: application/json" \
-d '{"item_no": "20522046"}'
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
curl -X POST https://api.scavio.dev/api/v1/ikea/reviews \
-H "Authorization: Bearer $SCAVIO_API_KEY" \
-H "Content-Type: application/json" \
-d '{"item_no": "80275887", "country": "de"}'
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
curl -X POST https://api.scavio.dev/api/v1/ikea/stock \
-H "Authorization: Bearer $SCAVIO_API_KEY" \
-H "Content-Type: application/json" \
-d '{"item_nos": ["20522046", "20631663"], "store_id": "399"}'
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
curl -X POST https://api.scavio.dev/api/v1/ikea/items \
-H "Authorization: Bearer $SCAVIO_API_KEY" \
-H "Content-Type: application/json" \
-d '{"item_nos": ["80275887", "00263850", "30275861"], "country": "de"}'
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
curl -X POST https://api.scavio.dev/api/v1/ikea/deals \
-H "Authorization: Bearer $SCAVIO_API_KEY" \
-H "Content-Type: application/json" \
-d '{"type": "new_lower_price", "country": "gb"}'
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
curl -X POST https://api.scavio.dev/api/v1/ikea/stores \
-H "Authorization: Bearer $SCAVIO_API_KEY" \
-H "Content-Type: application/json" \
-d '{"country": "se"}'
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
curl -X POST https://api.scavio.dev/api/v1/ikea/as-is \
-H "Authorization: Bearer $SCAVIO_API_KEY" \
-H "Content-Type: application/json" \
-d '{"store_id": "257"}'
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
curl -X POST https://api.scavio.dev/api/v1/ikea/search \
-H "Authorization: Bearer $SCAVIO_API_KEY" \
-H "Content-Type: application/json" \
-d '{"query": "kallax", "country": "pr"}'
The instruction to send zip for home-delivery availability transmits user location data to the third-party Scavio API. Although the API provider and parameter are documented, the skill does not warn the user that their postal code will be shared with that service.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
HEADERS = {"Authorization": f"Bearer {API_KEY}"}
def ikea(endpoint, body, timeout=180):
r = requests.post(f"{BASE}/api/v1/ikea/{endpoint}", headers=HEADERS, json=body, timeout=timeout)
r.raise_for_status()
return r.json()["data"]