Security audit
Security checks for vulnerabilities and agentic risk
This skill is a disclosed SEC EDGAR research helper that sends user-directed filing queries to Scavio's API and does not show hidden execution, persistence, or unrelated data access.
Install only if you are comfortable using Scavio as an intermediary for SEC EDGAR queries. Keep SCAVIO_API_KEY out of source control, monitor credit usage, and avoid sending confidential search terms if that matters to your workflow.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
HEADERS = {"Authorization": f"Bearer {API_KEY}"}
# 1. Resolve the ticker to a CIK - always start here
hits = requests.post(f"{BASE}/api/v1/sec/lookup", headers=HEADERS,
json={"query": "AAPL"}).json()
# 2. Filer profile
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
json={"query": "AAPL"}).json()
# 2. Filer profile
company = requests.post(f"{BASE}/api/v1/sec/company", headers=HEADERS,
json={"ticker": "AAPL"}).json()
# 3. Annual reports only - note this also brings back 10-K/A amendments
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
json={"ticker": "AAPL"}).json()
# 3. Annual reports only - note this also brings back 10-K/A amendments
filings = requests.post(f"{BASE}/api/v1/sec/filings", headers=HEADERS,
json={"ticker": "AAPL", "form": "10-K", "date_from": "2015-01-01", "limit": 100}).json()
# 4. Financials in two steps: discover the tag, then pull its history
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
json={"ticker": "AAPL", "form": "10-K", "date_from": "2015-01-01", "limit": 100}).json()
# 4. Financials in two steps: discover the tag, then pull its history
facts = requests.post(f"{BASE}/api/v1/sec/facts", headers=HEADERS,
json={"ticker": "AAPL", "query": "revenue"}).json()
revenue = requests.post(f"{BASE}/api/v1/sec/concept", headers=HEADERS,
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
facts = requests.post(f"{BASE}/api/v1/sec/facts", headers=HEADERS,
json={"ticker": "AAPL", "query": "revenue"}).json()
revenue = requests.post(f"{BASE}/api/v1/sec/concept", headers=HEADERS,
json={"ticker": "AAPL", "concept": "RevenueFromContractWithCustomerExcludingAssessedTax",
"taxonomy": "us-gaap", "unit": "USD"}).json()
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
"taxonomy": "us-gaap", "unit": "USD"}).json()
mentions = requests.post(f"{BASE}/api/v1/sec/search", headers=HEADERS, json={"query": ""material weakness"", "form": "8-K", "date_from": "2024-01-01", "sort": "newest", "page": 1}).json()
Subtle instructions detected that may alter agent decision-making or introduce hidden biases.
- Every call is 1 credit, including `include_history`, which can do up to 10 lookups for that one credit. Use it rather than paging blindly into the past.
- **XBRL tags are case-sensitive.** `netincomeloss` is a 404 upstream, not a fuzzy match. Never guess a tag - call `/sec/facts` and use one it actually reports.
- **`form` behaves differently on two endpoints.** On `/filings` it matches the form and its root form, so `10-K` also returns `10-K/A` amendments (ask for `10-K/A` to get amendments only). On `/concept` it is an exact match, so `10-K` excludes `10-K/A`. Do not carry an assumption from one to the other.
- EDGAR's "recent" block is **not a fixed window** - it can be a decade for a quiet filer and about a year for a prolific one. Never tell the user "this is everything" from a default `/filings` call; set `include_history` and check `history_truncated`.
- Full-text search coverage **starts in 2001**. A phrase absent from `/search` results is not proof it was never filed.
- Restatements are preserved in `/concept`. If you report a single number for a period, say which filing it came from.
- `ticker` wins over `cik` when both are sent - do not send a mismatched pair and expect the CIK to be honoured.