Security audit
Security checks for vulnerabilities and agentic risk
This is a coherent Reddit research skill that uses a disclosed third-party API, with the main consideration being careful handling of Reddit user activity data and API costs.
Install only if you are comfortable sending Reddit search terms, post IDs, subreddit names, and usernames to Scavio using your API key. Treat returned Reddit user profile, post, and comment data as privacy-sensitive, and monitor credit usage because each endpoint call is billed in credits.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
HEADERS = {"Authorization": f"Bearer {API_KEY}"}
# 1. Search Reddit
results = requests.post(f"{BASE}/api/v1/reddit/search", headers=HEADERS,
json={"query": "serpapi alternative"}).json()
post_id = results["data"]["results"][0]["post_id"]
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
post_id = results["data"]["results"][0]["post_id"]
# 2. Full post detail
post = requests.post(f"{BASE}/api/v1/reddit/post", headers=HEADERS,
json={"post_id": post_id}).json()
# 3. Top comments, then expand one thread
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
json={"post_id": post_id}).json()
# 3. Top comments, then expand one thread
comments = requests.post(f"{BASE}/api/v1/reddit/post/comments", headers=HEADERS,
json={"post_id": post_id, "sort": "TOP"}).json()
reply_cursor = comments["data"]["comments"][0]["reply_cursor"]
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
json={"post_id": post_id, "sort": "TOP"}).json()
reply_cursor = comments["data"]["comments"][0]["reply_cursor"]
replies = requests.post(f"{BASE}/api/v1/reddit/post/comments/replies", headers=HEADERS,
json={"post_id": post_id, "cursor": reply_cursor}).json()
# 4. Subreddit feed
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
json={"post_id": post_id, "cursor": reply_cursor}).json()
# 4. Subreddit feed
feed = requests.post(f"{BASE}/api/v1/reddit/subreddit/posts", headers=HEADERS,
json={"subreddit": "Python", "sort": "TOP"}).json()
# 5. Comment search, newest first - each hit carries its post and subreddit
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
json={"subreddit": "Python", "sort": "TOP"}).json()
# 5. Comment search, newest first - each hit carries its post and subreddit
hits = requests.post(f"{BASE}/api/v1/reddit/search/comments", headers=HEADERS,
json={"query": "web scraping api", "sort": "NEW"}).json()
for c in hits["data"]["results"]:
print(c["subreddit"], c["score"], c["post"]["title"], c["permalink"])
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
print(c["subreddit"], c["score"], c["post"]["title"], c["permalink"])
# 6. Find communities on a topic
subs = requests.post(f"{BASE}/api/v1/reddit/search/subreddits", headers=HEADERS,
json={"query": "web scraping"}).json()
for s in subs["data"]["results"]:
print(s["prefixed_name"], s["subscribers"])
This markdown file documents endpoints that retrieve identifiable Reddit user activity and profile data, including profile details and comment history. While the functionality is described, there is no explicit user-facing warning about privacy implications or responsible handling of collected user data.
Detected: suspicious.exposed_secret_literal