google-maps-api
Pass
Audited by Gen Agent Trust Hub on Sep 3, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill interacts exclusively with the vendor's official API domain (
api.scavio.dev). All documentation and support links point to the vendor's primary website (scavio.devandscavio.tech). - [SAFE]: The skill demonstrates secure credential handling by instructing users to load the
SCAVIO_API_KEYfrom environment variables or secret stores, explicitly advising against hardcoding them in source control. - [INDIRECT_PROMPT_INJECTION]: The skill processes data from external sources (Google Maps reviews and place information). While this presents a theoretical attack surface, the risk is mitigated by the skill's instructions to return only structured API data and the agent's internal guardrails.
- Ingestion points: Data enters the context via
local_results[],place_results, andreviews[]fields from theapi.scavio.devresponses inSKILL.md. - Boundary markers: The skill uses structured JSON responses which helps delineate data from instructions.
- Capability inventory: The skill uses standard network requests (POST) to a specific vendor endpoint. No arbitrary command execution or file system writes are present.
- Sanitization: The instructions explicitly state 'Never fabricate place names, ratings, addresses, or review text. Only return API data,' which discourages the agent from interpreting data as instructions.
Audit Metadata