Security audit
Security checks for vulnerabilities and agentic risk
ClawScan rates this skill benign with medium confidence: the reported API calls appear aligned with Nordstrom product lookups, though the scan was partial and flagged a missing notice about sharing location data.
Consider whether you are comfortable sending product queries and, for store searches, your ZIP code to Scavio. ClawScan’s verdict is benign, but confidence is medium and the scan was partial: it reported unresolved local references, so the evidence is incomplete.
L087 instructs the agent to call /nordstrom/stores with the user's ZIP code, and L718 repeats this instruction. Requests go to the third-party service at api.scavio.dev, but the skill does not warn the user that their location will be shared with Scavio rather than only with Nordstrom.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
curl -X POST https://api.scavio.dev/api/v1/nordstrom/product \
-H "Authorization: Bearer $SCAVIO_API_KEY" \
-H "Content-Type: application/json" \
-d '{"style_id": "8098974"}'
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
curl -X POST https://api.scavio.dev/api/v1/nordstrom/product \
-H "Authorization: Bearer $SCAVIO_API_KEY" \
-H "Content-Type: application/json" \
-d '{"style_id": "8098974"}'
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
curl -X POST https://api.scavio.dev/api/v1/nordstrom/category \
-H "Authorization: Bearer $SCAVIO_API_KEY" \
-H "Content-Type: application/json" \
-d '{"category": "/browse/women/clothing/dresses", "sort": "price_low"}'
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
curl -X POST https://api.scavio.dev/api/v1/nordstrom/brand \
-H "Authorization: Bearer $SCAVIO_API_KEY" \
-H "Content-Type: application/json" \
-d '{"brand": "/brands/astr-the-label--53360"}'
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
curl -X POST https://api.scavio.dev/api/v1/nordstrom/availability \
-H "Authorization: Bearer $SCAVIO_API_KEY" \
-H "Content-Type: application/json" \
-d '{"style_id": "7737947"}'
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
curl -X POST https://api.scavio.dev/api/v1/nordstrom/suggestions \
-H "Authorization: Bearer $SCAVIO_API_KEY" \
-H "Content-Type: application/json" \
-d '{"query": "nike air"}'
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
curl -X POST https://api.scavio.dev/api/v1/nordstrom/reviews \
-H "Authorization: Bearer $SCAVIO_API_KEY" \
-H "Content-Type: application/json" \
-d '{"style_id": "7737947", "max_reviews": 18}'
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
curl -X POST https://api.scavio.dev/api/v1/nordstrom/stores \
-H "Authorization: Bearer $SCAVIO_API_KEY" \
-H "Content-Type: application/json" \
-d '{"zip": "10001"}'
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
HEADERS = {"Authorization": f"Bearer {API_KEY}"}
def nordstrom(endpoint, body):
r = requests.post(f"{BASE}/api/v1/nordstrom/{endpoint}", headers=HEADERS, json=body, timeout=120)
r.raise_for_status()
return r.json()["data"]