airbnb-scraper-api
Pass
Audited by Gen Agent Trust Hub on Oct 12, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted third-party data retrieved from the Scavio API, including listing descriptions, host profiles, and guest review bodies. This content enters the agent's context and could potentially contain malicious instructions aimed at influencing the agent's behavior.
- Ingestion points: Data returned from the
/api/v1/airbnb/search,/api/v1/airbnb/listing, and/api/v1/airbnb/reviewsendpoints. - Boundary markers: The instructions lack explicit delimiters or warnings to the agent to treat the retrieved text as untrusted data, though it does provide guardrails to 'summarise' and 'not fabricate' content.
- Capability inventory: The skill performs network operations via
requestsand processes JSON data but does not exhibit file-write or shell-execution capabilities. - Sanitization: No explicit sanitization or filtering of the retrieved text is mentioned.
- [EXTERNAL_DOWNLOADS]: The skill documentation instructs users to install the
scaviopackage viapipandnpm. These are the official SDKs provided by the vendor for interacting with their API and are standard for this type of integration.
Audit Metadata