Security audit
Security checks for vulnerabilities and agentic risk
This is a disclosed Avito API reference skill with sensitive but purpose-aligned OAuth and messaging guidance, and no hidden code, persistence, or unrelated data flow.
Install only if you intend to let an agent help with Avito API work. Keep client secrets and bearer tokens out of logs, commits, and chat transcripts where possible; use least-privilege scopes and require explicit approval before sending messages, changing listings, or applying paid services.
This markdown file documents security-sensitive operations, including submission of client_secret to obtain tokens and later use of bearer tokens in API requests. The description does not warn users to protect these secrets, avoid exposing them in logs/shell history, or limit their handling, which is a missing user warning for behavior affecting credentials and account access.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Пример запроса:
curl -X POST 'https://api.avito.ru/token' \
-H 'Content-Type: application/x-www-form-urlencoded' \
--data-urlencode 'grant_type=client_credentials' \
--data-urlencode 'client_id=<CLIENT_ID>' \
The messenger and webhook sections describe access to chats, messages, images, and voice data without any privacy or data-handling cautions. In a skill that enables reading and sending user communications, omission of guidance on consent, retention, redaction, and secure storage can lead to improper collection or disclosure of sensitive personal data.
Most of the descriptive content and instructions are written in Russian, which can impose a language choice on users. The file does not indicate that Russian is optional, provide alternative language support, or justify the locale restriction as region-specific policy, so it constitutes a natural-language policy concern.
No suspicious patterns detected.