ClawHub
Back to skill

Security audit

Scavio Pinterest API

Security checks across malware telemetry and agentic risk

Overview

This skill is a straightforward Pinterest data lookup guide that uses Scavio's API, with the main user consideration being third-party sharing of submitted queries, usernames, pins, boards, and URLs.

Before installing, be comfortable with Scavio receiving the Pinterest searches, usernames, pin or board URLs, and external URLs you ask the agent to look up. Avoid sensitive investigations or private identifiers unless you accept that third-party processing, and keep the SCAVIO_API_KEY out of source control.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (5)

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The skill sends user-supplied Pinterest queries, usernames, pin URLs, board URLs, and external URLs to the third-party service api.scavio.dev, but the description does not clearly warn users about that data sharing. This creates a transparency and privacy risk because users may provide identifiers or research targets without understanding they are being transmitted off-platform to an external provider.

External Transmission

Medium
Category
Data Exfiltration
Content
HEADERS = {"Authorization": f"Bearer {API_KEY}"}

# 1. Search, then page with the returned cursor
first = requests.post(f"{BASE}/api/v1/pinterest/search", headers=HEADERS,
    json={"query": "home decor ideas"}).json()
cursor = first["data"]["cursor"]
nxt = requests.post(f"{BASE}/api/v1/pinterest/search", headers=HEADERS,
Confidence
88% confidence
Finding
requests.post(f"{BASE}/api/v1/pinterest/search", headers=HEADERS, json=

External Transmission

Medium
Category
Data Exfiltration
Content
first = requests.post(f"{BASE}/api/v1/pinterest/search", headers=HEADERS,
    json={"query": "home decor ideas"}).json()
cursor = first["data"]["cursor"]
nxt = requests.post(f"{BASE}/api/v1/pinterest/search", headers=HEADERS,
    json={"query": "home decor ideas", "cursor": cursor}).json()

# 2. One pin in full
Confidence
88% confidence
Finding
requests.post(f"{BASE}/api/v1/pinterest/search", headers=HEADERS, json=

External Transmission

Medium
Category
Data Exfiltration
Content
json={"query": "home decor ideas", "cursor": cursor}).json()

# 2. One pin in full
pin = requests.post(f"{BASE}/api/v1/pinterest/pin", headers=HEADERS,
    json={"pin": "https://www.pinterest.com/pin/104779128829676115/"}).json()

# 3. A creator's profile and boards
Confidence
90% confidence
Finding
requests.post(f"{BASE}/api/v1/pinterest/pin", headers=HEADERS, json=

External Transmission

Medium
Category
Data Exfiltration
Content
json={"pin": "https://www.pinterest.com/pin/104779128829676115/"}).json()

# 3. A creator's profile and boards
profile = requests.post(f"{BASE}/api/v1/pinterest/profile", headers=HEADERS,
    json={"username": "pinterest"}).json()

# 4. Save counts for two external URLs (1 credit for 1-5 URLs)
Confidence
90% confidence
Finding
requests.post(f"{BASE}/api/v1/pinterest/profile", headers=HEADERS, json=

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical
Code
suspicious.exposed_secret_literal
Location
SKILL.md:37