best-buy-product-data
Pass
Audited by Gen Agent Trust Hub on Nov 13, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill instructions direct the user to install vendor-specific packages from public registries.
- Provides commands to install
scavio==0.39.0via Python's pip andscavio@0.40.0via Node.js npm. - References the use of
@scavio/mcp-server@0.37.0via npx for Model Context Protocol integration. - [INDIRECT_PROMPT_INJECTION]: The skill ingests data from external sources that could theoretically contain malicious instructions intended to influence the agent.
- Ingestion points: The skill retrieves product descriptions, AI-generated review summaries, and customer reviews from bestbuy.com via the vendor's API.
- Boundary markers: The skill does not define specific delimiters or instructions for the agent to ignore potentially malicious content within these fields.
- Capability inventory: The agent can use retrieved data to make comparison decisions, track prices, and check availability.
- Sanitization: There is no evidence of sanitization or filtering of the ingested product data before it is processed by the agent.
Audit Metadata