Trendyol API - Product Prices, Seller Offers, Reviews, Rankings

• Outcome: Pass
• Latest audit: Nov 15, 2026 · 2:49 AM UTC
• Version: 1.0.1

Overview

ClawScan rates this skill benign with medium confidence: scanners found no AIG issues and judged its external Scavio API calls consistent with its purpose, while flagging a privacy disclosure gap; coverage is partial because some referenced local paths were missing.

The verdict is benign, but consider whether you are comfortable sending search terms and any supplied delivery-location identifiers to Scavio. Skillspector’s coverage is partial because some local references were missing, so the scan evidence is incomplete.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Output Handling: Unvalidated Output Injection, Cross-Context Output, Unbounded Output
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (15)

The workflow sends user search terms and delivery-location identifiers to Scavio without an explicit privacy warning.

Medium

• Category: Output Handling
• Confidence: 90% confidence

Finding

The workflow instructs the agent to submit search queries and city/district identifiers through Scavio's third-party API. Although the API destination is documented, the skill does not warn users that their shopping queries and supplied delivery-location information leave the agent environment; the privacy guardrail at L1105 only addresses data returned by the API.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 267)May include surrounding context.

Search

bash

curl -X POST https://api.scavio.dev/api/v1/trendyol/search \
  -H "Authorization: Bearer $SCAVIO_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"query": "telefon"}'

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 267)May include surrounding context.

Search

bash

curl -X POST https://api.scavio.dev/api/v1/trendyol/search \
  -H "Authorization: Bearer $SCAVIO_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"query": "telefon"}'

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 340)May include surrounding context.

Product (buy box and other sellers)

bash

curl -X POST https://api.scavio.dev/api/v1/trendyol/product \
  -H "Authorization: Bearer $SCAVIO_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"content_id": "975557855"}'

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 531)May include surrounding context.

Category and brand

bash

curl -X POST https://api.scavio.dev/api/v1/trendyol/category \
  -H "Authorization: Bearer $SCAVIO_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"category_id": "103498"}'

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 582)May include surrounding context.

Reviews

bash

curl -X POST https://api.scavio.dev/api/v1/trendyol/reviews \
  -H "Authorization: Bearer $SCAVIO_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"content_id": "975557855"}'

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 652)May include surrounding context.

Questions

bash

curl -X POST https://api.scavio.dev/api/v1/trendyol/questions \
  -H "Authorization: Bearer $SCAVIO_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"content_id": "975557855"}'

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 698)May include surrounding context.

Seller

bash

curl -X POST https://api.scavio.dev/api/v1/trendyol/seller \
  -H "Authorization: Bearer $SCAVIO_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"seller_id": "4473"}'

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 747)May include surrounding context.

Deals (tr)

bash

curl -X POST https://api.scavio.dev/api/v1/trendyol/deals \
  -H "Authorization: Bearer $SCAVIO_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{}'

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 824)May include surrounding context.

Coupons (tr)

bash

curl -X POST https://api.scavio.dev/api/v1/trendyol/coupons \
  -H "Authorization: Bearer $SCAVIO_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"content_id": "1164743007"}'

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 874)May include surrounding context.

Rankings

bash

curl -X POST https://api.scavio.dev/api/v1/trendyol/rankings \
  -H "Authorization: Bearer $SCAVIO_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"category_id": "56"}'

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 531)May include surrounding context.

Category and brand

bash

curl -X POST https://api.scavio.dev/api/v1/trendyol/category \
  -H "Authorization: Bearer $SCAVIO_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"category_id": "103498"}'

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 926)May include surrounding context.

Suggestions

bash

curl -X POST https://api.scavio.dev/api/v1/trendyol/suggestions \
  -H "Authorization: Bearer $SCAVIO_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"query": "iph"}'

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 981)May include surrounding context.

Delivery

bash

curl -X POST https://api.scavio.dev/api/v1/trendyol/delivery \
  -H "Authorization: Bearer $SCAVIO_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"content_id": "975557855", "city_id": "133", "district_id": "54"}'

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 70% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 1055)May include surrounding context.

md

HEADERS = {"Authorization": f"Bearer {API_KEY}"}

def ty(endpoint, body, timeout=180):
    r = requests.post(f"{BASE}/api/v1/trendyol/{endpoint}", headers=HEADERS, json=body, timeout=timeout)
    if r.status_code == 404:
        return None  # unknown, or not sold on that storefront (charged)
    r.raise_for_status()