google-hotels-api
Pass
Audited by Gen Agent Trust Hub on Sep 3, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes data from external API responses at runtime.
- Ingestion points: Data is ingested from the Scavio API via the
https://api.scavio.dev/api/v2/google/hotelsandhttps://api.scavio.dev/api/v2/google/hotels/detailendpoints. - Boundary markers: No specific boundary markers or 'ignore embedded instructions' warnings are provided for the API response data.
- Capability inventory: The skill is designed for data retrieval and does not involve subprocess calls, file writes, or other dangerous system capabilities based on the ingested data.
- Sanitization: No explicit sanitization or filtering of API response content is described.
- [EXTERNAL_DOWNLOADS]: The skill communicates with
api.scavio.devto fetch structured JSON data about hotels. These requests are standard for the skill's primary purpose and target the vendor's official API.
Audit Metadata