g2-software-reviews-api
Pass
Audited by Gen Agent Trust Hub on Sep 3, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [SAFE]: All network requests are directed to official vendor domains (api.scavio.dev, scavio.dev), which are consistent with the skill's stated purpose.
- [SAFE]: The skill correctly uses environment variables (SCAVIO_API_KEY) for secret management and does not contain hardcoded credentials.
- [INDIRECT_PROMPT_INJECTION]: The skill processes user-generated content from G2 (reviews), creating an attack surface for indirect prompt injection. 1. Ingestion points: Data ingested from the /api/v1/g2/product and /api/v1/g2/reviews endpoints as described in SKILL.md. 2. Boundary markers: No explicit markers are used to separate the external data from the agent's instructions. 3. Capability inventory: Network communication with api.scavio.dev via standard requests. 4. Sanitization: No content sanitization or escaping is implemented for the retrieved review text within the skill definition.
Audit Metadata