g2-software-reviews-api
Pass
Audited by Gen Agent Trust Hub on Oct 12, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill fetches software product data and reviews from the provider's API at api.scavio.dev and recommends the installation of the scavio library from NPM and PyPI. These are official resources associated with the skill's author and represent standard functionality for this service.
- [INDIRECT_PROMPT_INJECTION]: The skill processes external data from G2 software reviews. While this presents an attack surface where malicious instructions could be embedded in review text, the risk is inherent to tools that ingest web content and is managed by standard agent guardrails.
- Ingestion points: External data is retrieved from the /search, /product, and /reviews endpoints on api.scavio.dev (SKILL.md).
- Boundary markers: The instructions do not define specific delimiters for separating the fetched review data from the agent's instructions.
- Capability inventory: The skill has the capability to perform network requests to the vendor's API but does not have access to local file system operations, persistent storage, or shell execution.
- Sanitization: No specific sanitization or filtering of the review content is implemented within the skill instructions.
Audit Metadata