ClawHub
Back to skill

Security audit

Scavio Linkedin Ads

Security checks across malware telemetry and agentic risk

Overview

This skill only teaches an agent how to call Scavio’s LinkedIn ads API, with API key and credit use disclosed.

Install only if you are comfortable using Scavio as a third-party API provider for LinkedIn ad research. Keep SCAVIO_API_KEY in an environment variable or secret store, do not commit it to source control, and expect each query/detail call to consume credits.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (5)

External Transmission

Medium
Category
Data Exfiltration
Content
HEADERS = {"Authorization": f"Bearer {API_KEY}"}

# 1. Search ads by keyword, restricted to the US
search = requests.post(f"{BASE}/api/v1/linkedin/ads/search", headers=HEADERS,
    json={"keyword": "ai search", "countries": "US"}).json()
print(search["data"]["total_seen"], "ads seen")
for ad in search["data"]["ads"]:
Confidence
70% confidence
Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium
Category
Data Exfiltration
Content
HEADERS = {"Authorization": f"Bearer {API_KEY}"}

# 1. Search ads by keyword, restricted to the US
search = requests.post(f"{BASE}/api/v1/linkedin/ads/search", headers=HEADERS,
    json={"keyword": "ai search", "countries": "US"}).json()
print(search["data"]["total_seen"], "ads seen")
for ad in search["data"]["ads"]:
Confidence
70% confidence
Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium
Category
Data Exfiltration
Content
# 3. One ad in full, by an id from search
ad_id = search["data"]["ads"][0]["ad_id"]
detail = requests.post(f"{BASE}/api/v1/linkedin/ads/detail", headers=HEADERS,
    json={"ad_id": ad_id}).json()
d = detail["data"]
print(d["advertiser"], d["paid_for_by"], d["headline"])
Confidence
70% confidence
Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium
Category
Data Exfiltration
Content
curl:

```bash
curl -s https://api.scavio.dev/api/v1/linkedin/ads/search \
  -H "Authorization: Bearer $SCAVIO_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"keyword":"ai search","countries":"US"}'
Confidence
60% confidence
Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium
Category
Data Exfiltration
Content
curl:

```bash
curl -s https://api.scavio.dev/api/v1/linkedin/ads/search \
  -H "Authorization: Bearer $SCAVIO_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"keyword":"ai search","countries":"US"}'
Confidence
50% confidence
Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

VirusTotal

57/57 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical
Code
suspicious.exposed_secret_literal
Location
SKILL.md:36