Security audit
Security checks for vulnerabilities and agentic risk
The skill provides Target product lookups through Scavio, with clearly documented API access and no hidden or unrelated behavior.
Scavio receives your searches, product identifiers, and any supplied ZIP or store selection. Share only information you are comfortable sending to that provider, protect its API key, and monitor credit usage. The full artifact and scanner report were reviewed; the provider's live behavior and data-retention practices were not independently verified.
The workflow instructs the agent to submit search keywords and a US ZIP to Scavio's API. Although the service and endpoints are documented, the skill does not instruct the agent to warn users that their shopping queries and approximate location will be shared with a third-party provider rather than only Target.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
TIMEOUT = 120
# 1. Search (~9s)
results = requests.post(f"{BASE}/api/v1/target/search", headers=HEADERS, timeout=TIMEOUT,
json={"keyword": "airpods", "sort": "price_low", "count": 28}).json()
# 2. Category browse (~37s) - category_id is the segment after N- in a /c/ URL
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
json={"keyword": "airpods", "sort": "price_low", "count": 28}).json()
# 2. Category browse (~37s) - category_id is the segment after N- in a /c/ URL
category = requests.post(f"{BASE}/api/v1/target/category", headers=HEADERS, timeout=TIMEOUT,
json={"category_id": "5xtg6", "page": 1}).json()
# 3. Product detail by TCIN (~4s), priced at a specific store
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
json={"category_id": "5xtg6", "page": 1}).json()
# 3. Product detail by TCIN (~4s), priced at a specific store
product = requests.post(f"{BASE}/api/v1/target/product", headers=HEADERS, timeout=TIMEOUT,
json={"tcin": "1010453160", "store_id": "3991"}).json()
# 4. Reviews (~40s). Returns 8 bodies maximum, whatever review_count says.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
json={"tcin": "1010453160", "store_id": "3991"}).json()
# 4. Reviews (~40s). Returns 8 bodies maximum, whatever review_count says.
reviews = requests.post(f"{BASE}/api/v1/target/reviews", headers=HEADERS, timeout=TIMEOUT,
json={"tcin": "1010453160"}).json()
# 5. In-store stock at every Target near a ZIP (~3s)
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
json={"tcin": "1010453160"}).json()
# 5. In-store stock at every Target near a ZIP (~3s)
stock = requests.post(f"{BASE}/api/v1/target/availability", headers=HEADERS, timeout=TIMEOUT,
json={"tcin": "85978609", "zip": "79407"}).json()
for store in stock["data"]["stores"]:
print(store["name"], store["quantity"], store["in_store"], store["pickup"])
Subtle instructions detected that may alter agent decision-making or introduce hidden biases.
ver fabricate product names, prices, TCINs, ratings or review text. Only return data the API returned.
- **Do not overpromise speed.** Product is roughly 4s, search roughly 9s, category roughly 37s and reviews roughly 40s. If the user is building something interactive, tell them to run these in the background.
- **`/reviews` returns 8 review bodies maximum**, regardless of what `review_count` on the product says. `limit` only trims that set further. There is no `page` and no `offset` parameter. Never tell the user they can page through all reviews, and never present 8 bodies as the complete review corpus. The rating breakdown does cover all reviews.
- A null `seller_id` / `seller_name` means the item is sold by Target itself. Do not report it as missing or unknown data.
- `count` is capped at 28. Target rejects anything higher outright.
- Concurrency, not credits, is the real ceiling. Simultaneous requests are capped per plan and shared across Target, eBay, Walmart, Amazon and Google -