Security audit
Security checks for vulnerabilities and agentic risk
The scanners classify this skill as benign because its reported calls to Scavio fit its API purpose, while noting that postal codes may be shared without a privacy disclosure and the scan was partial.
The verdict is benign, not risk-free. Before installing, consider whether you are comfortable with delivery-estimate requests sharing a ZIP or postal code with Scavio. The scan was partial because some referenced paths could not be resolved, so the evidence is incomplete.
The workflow instructs the agent to submit a ZIP or Canadian postal code to the product endpoint hosted by Scavio, a third-party service. Although the API host and request parameters are documented, the skill does not warn users that their location data will be shared with Scavio to obtain the estimate.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
curl -X POST https://api.scavio.dev/api/v1/wayfair/search \
-H "Authorization: Bearer $SCAVIO_API_KEY" \
-H "Content-Type: application/json" \
-d '{"query": "office chair"}'
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
curl -X POST https://api.scavio.dev/api/v1/wayfair/search \
-H "Authorization: Bearer $SCAVIO_API_KEY" \
-H "Content-Type: application/json" \
-d '{"query": "office chair"}'
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
curl -X POST https://api.scavio.dev/api/v1/wayfair/category \
-H "Authorization: Bearer $SCAVIO_API_KEY" \
-H "Content-Type: application/json" \
-d '{"category_id": "413892", "sort": "price_asc"}'
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
curl -X POST https://api.scavio.dev/api/v1/wayfair/deals \
-H "Authorization: Bearer $SCAVIO_API_KEY" \
-H "Content-Type: application/json" \
-d '{}'
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
curl -X POST https://api.scavio.dev/api/v1/wayfair/product \
-H "Authorization: Bearer $SCAVIO_API_KEY" \
-H "Content-Type: application/json" \
-d '{"sku": "W005006988", "zip": "10001"}'
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
HEADERS = {"Authorization": f"Bearer {API_KEY}"}
def wayfair(endpoint, body, timeout=180):
r = requests.post(f"{BASE}/api/v1/wayfair/{endpoint}", headers=HEADERS, json=body, timeout=timeout)
r.raise_for_status()
return r.json()["data"]