costco-product-data
Pass
Audited by Gen Agent Trust Hub on Oct 24, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTIONREMOTE_CODE_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from an external API, which constitutes a potential attack surface for indirect prompt injection.
- Ingestion points: API responses from api.scavio.dev containing product titles, descriptions, and user reviews.
- Boundary markers: No specific delimiters or instructions to ignore embedded prompts are defined in the instructions for handling the external data.
- Capability inventory: The retrieved data is used to generate agent responses; no high-risk capabilities like file system access or command execution are performed using this data.
- Sanitization: The skill does not specify any sanitization or filtering of the API content.
- [EXTERNAL_DOWNLOADS]: Mentions official client libraries from the vendor.
- Evidence: Instructions for installing the scavio library via pip and npm.
- [REMOTE_CODE_EXECUTION]: The documentation provides instructions to run the vendor's official MCP server.
- Evidence: npx -y @scavio/mcp-server@0.16.1.
Audit Metadata