Security audit
Security checks for vulnerabilities and agentic risk
This skill is a disclosed Scavio API guide for reading public X data, with privacy considerations users should manage before broad collection.
Before installing, understand that use sends X search terms, handles, tweet IDs, community IDs, and your Scavio API key to Scavio, and can retrieve public people/profile/social-graph data. Use it only for lawful, policy-compliant research, avoid harassment or targeted surveillance, and get confirmation before broad pagination or retention of personal data.
The skill explicitly enables bulk retrieval of profiles, followers, followings, replies, and community posts, but it does not warn users about privacy, surveillance, or downstream misuse risks. In an agent context, this omission can normalize large-scale people-data collection and make operators less likely to apply consent, minimization, or policy checks before scraping.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
HEADERS = {"Authorization": f"Bearer {API_KEY}"}
# 1. Search — use "search", not "query"
results = requests.post(f"{BASE}/api/v1/x/search", headers=HEADERS,
json={"search": "AI agents", "search_type": "Latest"}).json()
tweet_id = results["data"]["timeline"][0]["tweet_id"]
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
tweet_id = results["data"]["timeline"][0]["tweet_id"]
# 2. Full tweet + its replies
tweet = requests.post(f"{BASE}/api/v1/x/tweet", headers=HEADERS,
json={"tweet_id": tweet_id}).json()
comments = requests.post(f"{BASE}/api/v1/x/tweet/comments", headers=HEADERS,
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
tweet = requests.post(f"{BASE}/api/v1/x/tweet", headers=HEADERS,
json={"tweet_id": tweet_id}).json()
comments = requests.post(f"{BASE}/api/v1/x/tweet/comments", headers=HEADERS,
json={"tweet_id": tweet_id, "rank": "latest"}).json()
# 3. A user's recent tweets
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
json={"tweet_id": tweet_id, "rank": "latest"}).json()
# 3. A user's recent tweets
user_tweets = requests.post(f"{BASE}/api/v1/x/user/tweets", headers=HEADERS,
json={"screen_name": "elonmusk"}).json()
# 4. Trending in a country
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
json={"screen_name": "elonmusk"}).json()
# 4. Trending in a country
trending = requests.post(f"{BASE}/api/v1/x/trending", headers=HEADERS,
json={"country": "UnitedStates"}).json()
# 5. Find a Community, then read its newest posts
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
json={"country": "UnitedStates"}).json()
# 5. Find a Community, then read its newest posts
found = requests.post(f"{BASE}/api/v1/x/search/communities", headers=HEADERS,
json={"keyword": "crypto"}).json()
community_id = found["data"]["communities"][0]["community_id"]
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
json={"keyword": "crypto"}).json()
community_id = found["data"]["communities"][0]["community_id"]
posts = requests.post(f"{BASE}/api/v1/x/community/tweets", headers=HEADERS,
json={"community_id": community_id, "ranking": "Recency"}).json()
for p in posts["data"]["timeline"]:
print(p["screen_name"], p["favorites"], p["text"][:80])
Detected: suspicious.exposed_secret_literal