foot-locker-api
Pass
Audited by Gen Agent Trust Hub on Nov 11, 2026
Risk Level: SAFE
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill documentation references official vendor SDKs ('scavio' on PyPI and NPM) and a specific MCP server ('@scavio/mcp-server'). These resources are consistent with the skill's authoring vendor.
- [CREDENTIALS_UNSAFE]: The skill uses placeholders for API keys in its examples. Crucially, the instructions include explicit security guidance for developers to store sensitive credentials in environment variables or secret managers rather than hardcoding them in source control.
- [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted third-party content from Foot Locker product reviews and shopper Q&A sections. While this is a known attack surface, the skill implements guardrails instructing the agent to quote text verbatim and avoid fabricating release dates, prices, or availability based on ingested data.
- [COMMAND_EXECUTION]: The skill provides example commands for environment setup and package installation. These are standard development practices for using the provided API and do not involve suspicious or obfuscated execution patterns.
Audit Metadata