google-news-api
Pass
Audited by Gen Agent Trust Hub on Sep 3, 2026
Risk Level: SAFE
Full Analysis
- [DATA_EXPOSURE]: The skill implements secure credential management by requiring the
SCAVIO_API_KEYenvironment variable. It explicitly instructs users to load keys from the environment or secret stores and warns to keep them out of source control. - [EXTERNAL_DOWNLOADS]: The skill communicates with
api.scavio.dev. This domain is an official resource for the skill author (scavio-ai) and is used for its intended purpose of retrieving news data. - [INDIRECT_PROMPT_INJECTION]: The skill processes user-provided search queries. While this is an ingestion point for untrusted data, the risk is minimized as the data is passed to a structured API endpoint, and the skill lacks dangerous capabilities like local file modification or arbitrary command execution.
- Ingestion points: User search terms passed to the
queryparameter inSKILL.md. - Boundary markers: Not explicitly defined for the query string.
- Capability inventory: Limited to network requests (
requests.post) to the vendor's API. - Sanitization: None explicitly mentioned for the query string, though it is transmitted as a JSON field.
Audit Metadata