fanatics-merchandise-api
Pass
Audited by Gen Agent Trust Hub on Nov 13, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill references and provides installation commands for the vendor's official SDKs and MCP server. These include the 'scavio' package for Python and Node.js, and the '@scavio/mcp-server' for Model Context Protocol integration. These resources are hosted on standard registries (PyPI, NPM) and originate from the skill's authoring vendor.
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from external sources, specifically product descriptions and user reviews from Fanatics storefronts.
- Ingestion points: Data is ingested through the
/fanatics/productand/fanatics/reviewsendpoints from the vendor's API. - Boundary markers: The instructions explicitly require the agent to label AI-generated summaries as 'Fanatics' AI-written summary' and to quote review text verbatim, which helps maintain context and prevents misattribution.
- Capability inventory: The skill is limited to performing network requests to the vendor's API and returning structured JSON data. It does not perform file system writes or local command execution.
- Sanitization: The API returns structured JSON, and the skill instructions advise against fabricating data, emphasizing adherence to the returned schema.
- [SAFE]: All network operations are directed to the vendor's infrastructure at 'api.scavio.dev' or related documentation sites. The skill follows best practices for secret management by instructing users to use environment variables for API keys rather than hardcoding them.
Audit Metadata