dollar-general-api
Pass
Audited by Gen Agent Trust Hub on Nov 1, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill recommends installing the
scaviolibrary from PyPI and NPM, and the@scavio/mcp-serverfrom the NPM registry. These are the author's official packages. - [COMMAND_EXECUTION]: The skill provides
curlcommands in the documentation to demonstrate API usage andexportcommands for environment variable setup. - [INDIRECT_PROMPT_INJECTION]: The skill processes data from external API responses which could contain untrusted content such as product descriptions or coupon details.
- Ingestion points: API responses from
https://api.scavio.devas described inSKILL.md. - Boundary markers: The 'Guardrails' section includes explicit instructions for the agent to 'Never fabricate prices, stock or coupons' and to 'Only return what the API returned'.
- Capability inventory: The skill is limited to making network requests to the Scavio API; it does not contain file system access or arbitrary code execution capabilities.
- Sanitization: The skill relies on structured JSON data returned from the API endpoints.
Audit Metadata