allegro-api
Pass
Audited by Gen Agent Trust Hub on Nov 12, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill references external packages for integration, including the
scaviolibrary for both Python (v0.51.0) and Node.js (v0.52.0), as well as therequestslibrary. These are official resources provided by the skill vendor. - [REMOTE_CODE_EXECUTION]: The skill's Model Context Protocol (MCP) configuration utilizes
npxto dynamically execute the@scavio/mcp-server@0.49.0package from the npm registry. - [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from the Allegro marketplace.
- Ingestion points: Untrusted content such as product titles, seller descriptions, and customer reviews are ingested into the agent's context from the Allegro marketplace via API responses.
- Boundary markers: The skill instructs the agent to quote returned values and only translate content around the data, providing a logical instruction-based boundary, though no structural delimiters (e.g., XML or triple backticks) are enforced.
- Capability inventory: The skill's capabilities are focused on network requests to the Scavio API. It does not provide tools for file system writes or subprocess execution that could be exploited by malicious data.
- Sanitization: There is no mention of sanitization or filtering of the raw marketplace text before it is presented to the agent.
Audit Metadata