glassdoor-salary-data
Pass
Audited by Gen Agent Trust Hub on Oct 31, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill references the installation of the vendor-provided SDK from standard registries (PyPI and npm).
- Evidence: Instructions include
pip install scavio==0.15.0andnpm install scavio@0.15.0in the SDKs section of SKILL.md. - [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted external data in the form of employee reviews and company profiles sourced from Glassdoor.
- Ingestion points: Data returned from the endpoints at
api.scavio.dev(SKILL.md). - Boundary markers: The skill does not explicitly instruct the agent to use delimiters or ignore instructions within the retrieved review text.
- Capability inventory: The skill performs network operations to fetch data and instructs the agent on how to interpret and summarize the results.
- Sanitization: No explicit sanitization of the review text or pros/cons is documented to prevent potential instruction injection within those fields.
Audit Metadata