dollar-general-api

Pass

Audited by Gen Agent Trust Hub on Nov 1, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill recommends installing the scavio library from PyPI and NPM, and the @scavio/mcp-server from the NPM registry. These are the author's official packages.
  • [COMMAND_EXECUTION]: The skill provides curl commands in the documentation to demonstrate API usage and export commands for environment variable setup.
  • [INDIRECT_PROMPT_INJECTION]: The skill processes data from external API responses which could contain untrusted content such as product descriptions or coupon details.
  • Ingestion points: API responses from https://api.scavio.dev as described in SKILL.md.
  • Boundary markers: The 'Guardrails' section includes explicit instructions for the agent to 'Never fabricate prices, stock or coupons' and to 'Only return what the API returned'.
  • Capability inventory: The skill is limited to making network requests to the Scavio API; it does not contain file system access or arbitrary code execution capabilities.
  • Sanitization: The skill relies on structured JSON data returned from the API endpoints.
Audit Metadata
Risk Level
SAFE
Analyzed
Nov 1, 2026, 09:15 PM