capterra-reviews-api
Pass
Audited by Gen Agent Trust Hub on Sep 3, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADS
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill recommends installing dependencies from official registries, which is a standard development practice. Specifically, it references the
scaviopackage on PyPI (pip install scavio==0.15.0) and NPM (npm install scavio@0.15.0). These references target official package managers and use pinned versions, which is a recommended security practice. - [CREDENTIALS_SAFE]: The skill correctly instructs users to manage their
SCAVIO_API_KEYvia environment variables (export SCAVIO_API_KEY=...) rather than hardcoding them. It also uses placeholders likesk_your_key_herein documentation examples, which does not pose a credential exposure risk. - [DATA_EXFILTRATION]: Network operations are restricted to the vendor's official API domain (
api.scavio.dev). There is no evidence of sensitive local file access or unauthorized data transmission to third-party domains. - [COMMAND_EXECUTION]: The skill provides standard command-line examples for setting environment variables and installing packages. These are informative and do not contain malicious payload injection or obfuscated scripts.
Audit Metadata