apple-app-store-api
Pass
Audited by Gen Agent Trust Hub on Sep 3, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from the Apple App Store, including app descriptions, release notes, and user-generated reviews, which could contain malicious instructions targeting the agent.
- Ingestion points: JSON data returned from endpoints under
https://api.scavio.dev/api/v1/appstore/(e.g.,/search,/app,/reviews). - Boundary markers: The skill instructions do not specify any delimiters or warnings for the agent to ignore embedded instructions in the fetched data.
- Capability inventory: The skill performs network operations via
requestsor thescavioSDK and processes structured data; it does not explicitly perform file system writes or subprocess execution itself. - Sanitization: There is no mention of sanitization or filtering of the external content before it is processed by the agent.
- [EXTERNAL_DOWNLOADS]: The skill documentation recommends installing the vendor-specific
scavioSDK viapipornpm(version 0.15.0). These are official resources provided by the skill vendor for interacting with their API.
Audit Metadata