ashley-furniture-api
Pass
Audited by Gen Agent Trust Hub on Nov 14, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted external data from international Ashley Furniture storefronts, including product descriptions, customer reviews, and Q&A sections.
- Ingestion points: Untrusted data enters the agent context through the search and product endpoints at api.scavio.dev.
- Boundary markers: The skill includes an extensive Guardrails section that provides specific instructions to the agent on how to interpret data fields and avoid common misinterpretations.
- Capability inventory: The skill acts as a data provider; specific risks depend on the tool-execution capabilities of the agent consuming this data.
- Sanitization: No explicit sanitization or filtering of the retrieved text is mentioned in the documentation.
- [EXTERNAL_DOWNLOADS]: The skill recommends installing several vendor-maintained packages from public registries.
- Details: Suggests installing scavio (Python and Node.js) and @scavio/mcp-server to interact with the API.
- [COMMAND_EXECUTION]: The documentation provides example CLI commands for configuration and testing.
- Details: Includes examples for setting environment variables, using curl for API calls, and using package managers like pip, npm, and npx for setup.
Audit Metadata