Security audit
Security checks for vulnerabilities and agentic risk
ClawScan marked this skill benign because the reported external API requests appear aligned with its purpose, while noting a privacy disclosure gap and incomplete reference checks.
Consider that store lookups may send your postcode to Scavio, and avoid sharing more location information than needed. The verdict is benign with medium confidence, but Skillspector reports partial analysis: several local references could not be resolved, so the evidence is incomplete.
The workflow instructs the agent to submit a postcode to /stores, which uses the third-party Scavio API. Although the API provider and request format are documented, the skill does not warn the user that their supplied location information will be transmitted to Scavio rather than only to Maisons du Monde.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
curl -X POST https://api.scavio.dev/api/v1/maisonsdumonde/search \
-H "Authorization: Bearer $SCAVIO_API_KEY" \
-H "Content-Type: application/json" \
-d '{"query": "table"}'
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
curl -X POST https://api.scavio.dev/api/v1/maisonsdumonde/search \
-H "Authorization: Bearer $SCAVIO_API_KEY" \
-H "Content-Type: application/json" \
-d '{"query": "table"}'
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
curl -X POST https://api.scavio.dev/api/v1/maisonsdumonde/product \
-H "Authorization: Bearer $SCAVIO_API_KEY" \
-H "Content-Type: application/json" \
-d '{"id": "186339"}'
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
curl -X POST https://api.scavio.dev/api/v1/maisonsdumonde/category \
-H "Authorization: Bearer $SCAVIO_API_KEY" \
-H "Content-Type: application/json" \
-d '{"category": "canapes-n4dc562d7bb509362a3a2102db4cbf90b6454f1f"}'
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
curl -X POST https://api.scavio.dev/api/v1/maisonsdumonde/deals \
-H "Authorization: Bearer $SCAVIO_API_KEY" \
-H "Content-Type: application/json" \
-d '{"event": "black_friday"}'
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
curl -X POST https://api.scavio.dev/api/v1/maisonsdumonde/reviews \
-H "Authorization: Bearer $SCAVIO_API_KEY" \
-H "Content-Type: application/json" \
-d '{"id": "186339"}'
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Then the stock of item 204172 at store 125:
curl -X POST https://api.scavio.dev/api/v1/maisonsdumonde/availability \
-H "Authorization: Bearer $SCAVIO_API_KEY" \
-H "Content-Type: application/json" \
-d '{"id": "204172", "store_id": "125"}'
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
And one store:
curl -X POST https://api.scavio.dev/api/v1/maisonsdumonde/store \
-H "Authorization: Bearer $SCAVIO_API_KEY" \
-H "Content-Type: application/json" \
-d '{"store_id": "41"}'
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
curl -X POST https://api.scavio.dev/api/v1/maisonsdumonde/seller \
-H "Authorization: Bearer $SCAVIO_API_KEY" \
-H "Content-Type: application/json" \
-d '{"seller_id": "2066"}'
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
curl -X POST https://api.scavio.dev/api/v1/maisonsdumonde/stores \
-H "Authorization: Bearer $SCAVIO_API_KEY" \
-H "Content-Type: application/json" \
-d '{"postcode": "75011"}'
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
HEADERS = {"Authorization": f"Bearer {API_KEY}"}
def mdm(endpoint, body, timeout=180):
r = requests.post(f"{BASE}/api/v1/maisonsdumonde/{endpoint}", headers=HEADERS, json=body, timeout=timeout)
if r.status_code == 404:
return None # not sold in that market (charged)
r.raise_for_status()