canadian-tire-api
Pass
Audited by Gen Agent Trust Hub on Nov 1, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill requires installing the
scaviolibrary for Python and Node.js. These are vendor-owned packages maintained by the skill author, scavio-ai.\n- [REMOTE_CODE_EXECUTION]: The setup instructions include executing@scavio/mcp-servervianpx, which downloads and runs a package from the npm registry. This is the vendor's standard method for providing MCP server functionality.\n- [INDIRECT_PROMPT_INJECTION]: The skill retrieves retail data from external API endpoints, creating a surface where malicious instructions could be embedded in product or store metadata.\n - Ingestion points: Product descriptions, features, and specifications returned by the
api.scavio.devendpoints.\n - Boundary markers: The instructions include a 'Guardrails' section which explicitly directs the agent not to fabricate data and to strictly return the values provided by the API.\n
- Capability inventory: The skill allows network-based data retrieval but does not have capabilities for file system modification or local shell command execution.\n
- Sanitization: Data is processed and returned in structured JSON format.
Audit Metadata