ClawHub
Back to skill

Security audit

scavio-tiktok

Security checks across malware telemetry and agentic risk

Overview

This is a disclosed Scavio/TikTok API helper with no hidden install, persistence, or unrelated data access, though users should know their TikTok queries are sent to Scavio.

Install this only if you are comfortable sending TikTok usernames, video IDs, hashtags, search terms, and follower/comment lookup requests to Scavio. Use care with sensitive investigations, limit bulk pagination, and protect the SCAVIO_API_KEY.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (16)

Missing User Warnings

Medium
Confidence
92% confidence
Finding
The skill explicitly sends TikTok-related inputs such as usernames, video IDs, comments, hashtags, and follower/following queries to the third-party Scavio API, but it does not warn users that these inputs will leave the local environment. This is dangerous because users or downstream agents may unknowingly transmit potentially sensitive research targets, social-graph interests, or personal data to an external service.

External Transmission

Medium
Category
Data Exfiltration
Content
HEADERS = {"Authorization": f"Bearer {os.environ['SCAVIO_API_KEY']}"}

# 1. Look up a profile
profile = requests.post(f"{BASE}/api/v1/tiktok/profile", headers=HEADERS,
    json={"username": "tiktok"}).json()

sec_uid = profile["data"]["user"]["sec_uid"]
Confidence
88% confidence
Finding
requests.post(f"{BASE}/api/v1/tiktok/profile", headers=HEADERS, json=

External Transmission

Medium
Category
Data Exfiltration
Content
print(f"{profile['data']['user']['nickname']}: {profile['data']['user']['follower_count']} followers")

# 2. List their most popular videos
posts = requests.post(f"{BASE}/api/v1/tiktok/user/posts", headers=HEADERS,
    json={"sec_user_id": sec_uid, "sort_type": "1", "count": 5}).json()

for v in posts["data"]["aweme_list"]:
Confidence
88% confidence
Finding
requests.post(f"{BASE}/api/v1/tiktok/user/posts", headers=HEADERS, json=

External Transmission

Medium
Category
Data Exfiltration
Content
print(f"{v['desc'][:60]}  -- {v['statistics']['play_count']} views")

# 3. Get details for a specific video
video = requests.post(f"{BASE}/api/v1/tiktok/video", headers=HEADERS,
    json={"video_id": "7350810998023949599"}).json()

detail = video["data"]["aweme_detail"]
Confidence
84% confidence
Finding
requests.post(f"{BASE}/api/v1/tiktok/video", headers=HEADERS, json=

External Transmission

Medium
Category
Data Exfiltration
Content
print(f"Likes: {detail['statistics']['digg_count']}, Comments: {detail['statistics']['comment_count']}")

# 4. Read comments on that video
comments = requests.post(f"{BASE}/api/v1/tiktok/video/comments", headers=HEADERS,
    json={"video_id": "7350810998023949599", "count": 10}).json()

for c in comments["data"]["comments"]:
Confidence
90% confidence
Finding
requests.post(f"{BASE}/api/v1/tiktok/video/comments", headers=HEADERS, json=

External Transmission

Medium
Category
Data Exfiltration
Content
print(f"@{c['user']['unique_id']}: {c['text']}")

# 5. Search for videos
results = requests.post(f"{BASE}/api/v1/tiktok/search/videos", headers=HEADERS,
    json={"keyword": "cooking recipe", "count": 10, "publish_time": "7"}).json()

# 6. Explore a hashtag
Confidence
87% confidence
Finding
requests.post(f"{BASE}/api/v1/tiktok/search/videos", headers=HEADERS, json=

External Transmission

Medium
Category
Data Exfiltration
Content
json={"keyword": "cooking recipe", "count": 10, "publish_time": "7"}).json()

# 6. Explore a hashtag
tag = requests.post(f"{BASE}/api/v1/tiktok/hashtag", headers=HEADERS,
    json={"hashtag_name": "fyp"}).json()

tag_id = tag["data"]["challengeInfo"]["challenge"]["id"]
Confidence
85% confidence
Finding
requests.post(f"{BASE}/api/v1/tiktok/hashtag", headers=HEADERS, json=

External Transmission

Medium
Category
Data Exfiltration
Content
| Endpoint | Credits | Description |
|---|---|---|
| `POST https://api.scavio.dev/api/v1/tiktok/profile` | 1 | Get user profile by username or sec_user_id |
| `POST https://api.scavio.dev/api/v1/tiktok/user/posts` | 1 | List a user's videos (paginated, sortable) |
| `POST https://api.scavio.dev/api/v1/tiktok/video` | 1 | Get full details for a single video |
| `POST https://api.scavio.dev/api/v1/tiktok/video/comments` | 1 | List comments on a video |
Confidence
81% confidence
Finding
https://api.scavio.dev/

External Transmission

Medium
Category
Data Exfiltration
Content
| Endpoint | Credits | Description |
|---|---|---|
| `POST https://api.scavio.dev/api/v1/tiktok/profile` | 1 | Get user profile by username or sec_user_id |
| `POST https://api.scavio.dev/api/v1/tiktok/user/posts` | 1 | List a user's videos (paginated, sortable) |
| `POST https://api.scavio.dev/api/v1/tiktok/video` | 1 | Get full details for a single video |
| `POST https://api.scavio.dev/api/v1/tiktok/video/comments` | 1 | List comments on a video |
| `POST https://api.scavio.dev/api/v1/tiktok/video/comments/replies` | 1 | List replies to a specific comment |
Confidence
81% confidence
Finding
https://api.scavio.dev/

External Transmission

Medium
Category
Data Exfiltration
Content
|---|---|---|
| `POST https://api.scavio.dev/api/v1/tiktok/profile` | 1 | Get user profile by username or sec_user_id |
| `POST https://api.scavio.dev/api/v1/tiktok/user/posts` | 1 | List a user's videos (paginated, sortable) |
| `POST https://api.scavio.dev/api/v1/tiktok/video` | 1 | Get full details for a single video |
| `POST https://api.scavio.dev/api/v1/tiktok/video/comments` | 1 | List comments on a video |
| `POST https://api.scavio.dev/api/v1/tiktok/video/comments/replies` | 1 | List replies to a specific comment |
| `POST https://api.scavio.dev/api/v1/tiktok/search/videos` | 1 | Search videos by keyword |
Confidence
80% confidence
Finding
https://api.scavio.dev/

External Transmission

Medium
Category
Data Exfiltration
Content
| `POST https://api.scavio.dev/api/v1/tiktok/profile` | 1 | Get user profile by username or sec_user_id |
| `POST https://api.scavio.dev/api/v1/tiktok/user/posts` | 1 | List a user's videos (paginated, sortable) |
| `POST https://api.scavio.dev/api/v1/tiktok/video` | 1 | Get full details for a single video |
| `POST https://api.scavio.dev/api/v1/tiktok/video/comments` | 1 | List comments on a video |
| `POST https://api.scavio.dev/api/v1/tiktok/video/comments/replies` | 1 | List replies to a specific comment |
| `POST https://api.scavio.dev/api/v1/tiktok/search/videos` | 1 | Search videos by keyword |
| `POST https://api.scavio.dev/api/v1/tiktok/search/users` | 1 | Search users by keyword |
Confidence
83% confidence
Finding
https://api.scavio.dev/

External Transmission

Medium
Category
Data Exfiltration
Content
| `POST https://api.scavio.dev/api/v1/tiktok/user/posts` | 1 | List a user's videos (paginated, sortable) |
| `POST https://api.scavio.dev/api/v1/tiktok/video` | 1 | Get full details for a single video |
| `POST https://api.scavio.dev/api/v1/tiktok/video/comments` | 1 | List comments on a video |
| `POST https://api.scavio.dev/api/v1/tiktok/video/comments/replies` | 1 | List replies to a specific comment |
| `POST https://api.scavio.dev/api/v1/tiktok/search/videos` | 1 | Search videos by keyword |
| `POST https://api.scavio.dev/api/v1/tiktok/search/users` | 1 | Search users by keyword |
| `POST https://api.scavio.dev/api/v1/tiktok/hashtag` | 1 | Get hashtag details and stats |
Confidence
82% confidence
Finding
https://api.scavio.dev/

External Transmission

Medium
Category
Data Exfiltration
Content
| `POST https://api.scavio.dev/api/v1/tiktok/video` | 1 | Get full details for a single video |
| `POST https://api.scavio.dev/api/v1/tiktok/video/comments` | 1 | List comments on a video |
| `POST https://api.scavio.dev/api/v1/tiktok/video/comments/replies` | 1 | List replies to a specific comment |
| `POST https://api.scavio.dev/api/v1/tiktok/search/videos` | 1 | Search videos by keyword |
| `POST https://api.scavio.dev/api/v1/tiktok/search/users` | 1 | Search users by keyword |
| `POST https://api.scavio.dev/api/v1/tiktok/hashtag` | 1 | Get hashtag details and stats |
| `POST https://api.scavio.dev/api/v1/tiktok/hashtag/videos` | 1 | List videos for a hashtag |
Confidence
81% confidence
Finding
https://api.scavio.dev/

External Transmission

Medium
Category
Data Exfiltration
Content
| `POST https://api.scavio.dev/api/v1/tiktok/video/comments` | 1 | List comments on a video |
| `POST https://api.scavio.dev/api/v1/tiktok/video/comments/replies` | 1 | List replies to a specific comment |
| `POST https://api.scavio.dev/api/v1/tiktok/search/videos` | 1 | Search videos by keyword |
| `POST https://api.scavio.dev/api/v1/tiktok/search/users` | 1 | Search users by keyword |
| `POST https://api.scavio.dev/api/v1/tiktok/hashtag` | 1 | Get hashtag details and stats |
| `POST https://api.scavio.dev/api/v1/tiktok/hashtag/videos` | 1 | List videos for a hashtag |
| `POST https://api.scavio.dev/api/v1/tiktok/user/followers` | 1 | List a user's followers |
Confidence
86% confidence
Finding
https://api.scavio.dev/

External Transmission

Medium
Category
Data Exfiltration
Content
| `POST https://api.scavio.dev/api/v1/tiktok/video/comments/replies` | 1 | List replies to a specific comment |
| `POST https://api.scavio.dev/api/v1/tiktok/search/videos` | 1 | Search videos by keyword |
| `POST https://api.scavio.dev/api/v1/tiktok/search/users` | 1 | Search users by keyword |
| `POST https://api.scavio.dev/api/v1/tiktok/hashtag` | 1 | Get hashtag details and stats |
| `POST https://api.scavio.dev/api/v1/tiktok/hashtag/videos` | 1 | List videos for a hashtag |
| `POST https://api.scavio.dev/api/v1/tiktok/user/followers` | 1 | List a user's followers |
| `POST https://api.scavio.dev/api/v1/tiktok/user/followings` | 1 | List accounts a user follows |
Confidence
86% confidence
Finding
https://api.scavio.dev/

External Transmission

Medium
Category
Data Exfiltration
Content
| `POST https://api.scavio.dev/api/v1/tiktok/search/videos` | 1 | Search videos by keyword |
| `POST https://api.scavio.dev/api/v1/tiktok/search/users` | 1 | Search users by keyword |
| `POST https://api.scavio.dev/api/v1/tiktok/hashtag` | 1 | Get hashtag details and stats |
| `POST https://api.scavio.dev/api/v1/tiktok/hashtag/videos` | 1 | List videos for a hashtag |
| `POST https://api.scavio.dev/api/v1/tiktok/user/followers` | 1 | List a user's followers |
| `POST https://api.scavio.dev/api/v1/tiktok/user/followings` | 1 | List accounts a user follows |
Confidence
79% confidence
Finding
https://api.scavio.dev/

VirusTotal

63/63 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical
Code
suspicious.exposed_secret_literal
Location
SKILL.md:40