Security audit
Security checks for vulnerabilities and agentic risk
This skill is a disclosed Trustpilot data API guide that sends user-requested queries to Scavio and returns public review and business data.
Before installing, understand that queries and your Scavio API key are sent to Scavio, API calls consume paid or free credits, and returned business contact details or review data should be used in line with privacy laws, platform terms, and the user's stated intent.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
curl -X POST https://api.scavio.dev/api/v1/trustpilot/reviews \
-H "Authorization: Bearer $SCAVIO_API_KEY" \
-H "Content-Type: application/json" \
-d '{"domain": "nordvpn.com", "stars": [1, 2], "language": "en"}'
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
curl -X POST https://api.scavio.dev/api/v1/trustpilot/reviews \
-H "Authorization: Bearer $SCAVIO_API_KEY" \
-H "Content-Type: application/json" \
-d '{"domain": "nordvpn.com", "stars": [1, 2], "language": "en"}'
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
HEADERS = {"Authorization": f"Bearer {API_KEY}"}
def trustpilot(endpoint, body):
r = requests.post(f"{BASE}/api/v1/trustpilot/{endpoint}", headers=HEADERS, json=body)
r.raise_for_status()
return r.json()["data"]
The markdown explicitly states that search and business endpoints can return published email, phone, and address data, and it promotes building lead lists from that information. However, it does not include a clear user-facing warning about privacy-sensitive handling or downstream use of that contact data. For markdown files, omissions around behaviors that could affect user privacy are in scope.
Detected: suspicious.exposed_secret_literal