Security audit
Security checks for vulnerabilities and agentic risk
This skill is a documented wrapper guide for Scavio's Kuaishou public-data API and does not show hidden execution, persistence, or unrelated data access.
Install this only if you are comfortable using Scavio as a third-party API provider for Kuaishou research. Keep your SCAVIO_API_KEY out of source control, review per-endpoint credit costs before multi-page searches or batch calls, and avoid sending private or unnecessary identifiers in lookup requests.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
HEADERS = {"Authorization": f"Bearer {API_KEY}"}
# 1. Share link -> user id (1 credit)
resolved = requests.post(f"{BASE}/api/v1/kuaishou/user/resolve", headers=HEADERS,
json={"share_link": "https://v.kuaishou.com/KcdKDwFp"}).json()
user_id = "5518803932"
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
user_id = "5518803932"
# 2. Their posts (1 credit) - far cheaper than /profile, which is 10
posts = requests.post(f"{BASE}/api/v1/kuaishou/user/posts", headers=HEADERS,
json={"user_id": user_id}).json()
# 3. Full profile - 10 credits, only call it if you need the profile fields
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
json={"user_id": user_id}).json()
# 3. Full profile - 10 credits, only call it if you need the profile fields
profile = requests.post(f"{BASE}/api/v1/kuaishou/profile", headers=HEADERS,
json={"user_id": user_id}).json()
# 4. A single video (2 credits)
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
json={"user_id": user_id}).json()
# 4. A single video (2 credits)
video = requests.post(f"{BASE}/api/v1/kuaishou/video", headers=HEADERS,
json={"photo_id": "3xtdqvdnqd3psuc"}).json()
# 5. Comments (1 credit), then one thread's replies (1 credit).
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
# 5. Comments (1 credit), then one thread's replies (1 credit).
# NOTE the path is /video/sub-comments.
comments = requests.post(f"{BASE}/api/v1/kuaishou/video/comments", headers=HEADERS,
json={"photo_id": "5218546261880462502"}).json()
replies = requests.post(f"{BASE}/api/v1/kuaishou/video/sub-comments", headers=HEADERS,
json={"photo_id": "5218546261880462502",
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
# NOTE the path is /video/sub-comments.
comments = requests.post(f"{BASE}/api/v1/kuaishou/video/comments", headers=HEADERS,
json={"photo_id": "5218546261880462502"}).json()
replies = requests.post(f"{BASE}/api/v1/kuaishou/video/sub-comments", headers=HEADERS,
json={"photo_id": "5218546261880462502",
"root_comment_id": "14000000123456789", "count": 20}).json()
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
"root_comment_id": "14000000123456789", "count": 20}).json()
# 6. Search - 10 credits PER PAGE
found = requests.post(f"{BASE}/api/v1/kuaishou/search/videos", headers=HEADERS,
json={"keyword": "美妆"}).json()
# 7. Cheap discovery: hashtag feed and leaderboards, 1 credit each
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
json={"keyword": "美妆"}).json()
# 7. Cheap discovery: hashtag feed and leaderboards, 1 credit each
tag = requests.post(f"{BASE}/api/v1/kuaishou/tag/feed", headers=HEADERS,
json={"tag": "挑战"}).json()
board = requests.post(f"{BASE}/api/v1/kuaishou/trending", headers=HEADERS,
json={"board": "hot"}).json()
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
# 7. Cheap discovery: hashtag feed and leaderboards, 1 credit each
tag = requests.post(f"{BASE}/api/v1/kuaishou/tag/feed", headers=HEADERS,
json={"tag": "挑战"}).json()
board = requests.post(f"{BASE}/api/v1/kuaishou/trending", headers=HEADERS,
json={"board": "hot"}).json()
# 8. Batch - 40 credits, max 20 ids
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
json={"board": "hot"}).json()
batch = requests.post(f"{BASE}/api/v1/kuaishou/videos/batch", headers=HEADERS, json={"photo_ids": ["5228960823332207296", "5196309727975443273"]}).json()