Security audit
Security checks for vulnerabilities and agentic risk
This skill is a straightforward Scavio Weibo API guide; it sends Weibo IDs and search queries to Scavio as expected, with no hidden execution, persistence, or local data access.
Before installing, be aware that Weibo identifiers, post IDs, search terms, and request metadata will be sent to Scavio and may cost credits. Avoid submitting confidential research topics, secrets, regulated personal data, or sensitive investigative targets unless you are comfortable sharing them with that service.
The skill sends user-supplied identifiers and search queries to a third-party service but does not clearly warn users that their inputs will leave the local environment. This creates a real privacy and consent issue because requests may include potentially sensitive handles, post IDs, or research topics, and users may not realize that data is being transmitted to Scavio.
This example performs an authenticated outbound request to a third-party API and transmits a user identifier externally. While expected for the skill's purpose, it is still a genuine data egress point and can expose user-provided identifiers or investigative targets to an external provider if used without notice or consent.
HEADERS = {"Authorization": f"Bearer {API_KEY}"}
# 1. A user's profile, then their posts
info = requests.post(f"{BASE}/api/v1/weibo/user/info", headers=HEADERS,
json={"uid": "7277477906"}).json()
posts = requests.post(f"{BASE}/api/v1/weibo/user/posts", headers=HEADERS,
json={"uid": "7277477906", "page": 1}).json()
This request transmits a Weibo user ID and pagination data to the external Scavio API. The behavior matches the advertised functionality, but it still constitutes third-party disclosure of user-supplied targets and may reveal monitoring or profiling activity if used on sensitive accounts.
# 1. A user's profile, then their posts
info = requests.post(f"{BASE}/api/v1/weibo/user/info", headers=HEADERS,
json={"uid": "7277477906"}).json()
posts = requests.post(f"{BASE}/api/v1/weibo/user/posts", headers=HEADERS,
json={"uid": "7277477906", "page": 1}).json()
# 2. A post and its comments
This example sends a post ID and options to an external API, creating a data egress path. Even if the post is public, the queried target and timing of the request may still be sensitive in investigative, compliance, or user-research contexts.
json={"uid": "7277477906", "page": 1}).json()
# 2. A post and its comments
post = requests.post(f"{BASE}/api/v1/weibo/post", headers=HEADERS,
json={"id": "5092682368025584", "is_get_long_text": "true"}).json()
comments = requests.post(f"{BASE}/api/v1/weibo/post/comments", headers=HEADERS,
json={"id": "5092682368025584", "count": 50}).json()
This outbound request sends a post ID and comment retrieval parameters to a third-party service. The skill context makes such transmission expected, but it remains a privacy-relevant external call because it may disclose what content a user is analyzing and can expose personal data in returned comments.
# 2. A post and its comments
post = requests.post(f"{BASE}/api/v1/weibo/post", headers=HEADERS,
json={"id": "5092682368025584", "is_get_long_text": "true"}).json()
comments = requests.post(f"{BASE}/api/v1/weibo/post/comments", headers=HEADERS,
json={"id": "5092682368025584", "count": 50}).json()
# 3. Realtime keyword search and the hot-search board
This request sends a free-form search query to the external API, which is more sensitive than fixed IDs because queries can contain proprietary research interests, personal data, or investigative intent. Without an explicit warning, users may unknowingly disclose sensitive topics to the service provider.
json={"id": "5092682368025584", "count": 50}).json()
# 3. Realtime keyword search and the hot-search board
realtime = requests.post(f"{BASE}/api/v1/weibo/search/realtime", headers=HEADERS,
json={"query": "yu7"}).json()
hot = requests.post(f"{BASE}/api/v1/weibo/hot-search", headers=HEADERS,
json={}).json()
This example calls a third-party endpoint with an empty JSON body, so the privacy impact is lower than identifier-bearing requests. However, it still establishes outbound network access using the API key and should be disclosed as an external dependency and data transfer to Scavio.
realtime = requests.post(f"{BASE}/api/v1/weibo/search/realtime", headers=HEADERS, json={"query": "yu7"}).json() hot = requests.post(f"{BASE}/api/v1/weibo/hot-search", headers=HEADERS, json={}).json()
The hardcoded external base URL itself is not malicious, but it confirms that the skill depends on a remote third-party service for operation. In context, the risk is not the URL alone but the undisclosed external routing of user requests and associated metadata to that domain.
curl:
curl -s https://api.scavio.dev/api/v1/weibo/hot-search \
-H "Authorization: Bearer $SCAVIO_API_KEY" \
-H "Content-Type: application/json" \
-d '{}'
The hardcoded external base URL itself is not malicious, but it confirms that the skill depends on a remote third-party service for operation. In context, the risk is not the URL alone but the undisclosed external routing of user requests and associated metadata to that domain.
curl:
curl -s https://api.scavio.dev/api/v1/weibo/hot-search \
-H "Authorization: Bearer $SCAVIO_API_KEY" \
-H "Content-Type: application/json" \
-d '{}'