harbor-freight-api
Pass
Audited by Gen Agent Trust Hub on Nov 2, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill documentation includes instructions for installing official vendor packages from standard registries.
- References
scavio==0.33.0on PyPI andscavio@0.33.0on NPM. - Mentions the
@scavio/mcp-server@0.31.0package for Model Context Protocol support via npx. - All resources are consistent with the skill author (scavio-ai) and reside on well-known package registries.
- [INDIRECT_PROMPT_INJECTION]: The skill processes external data from the Harbor Freight API which could potentially contain untrusted content.
- Ingestion points: API response fields from endpoints defined in
SKILL.md(e.g., product descriptions, highlights, and customer reviews). - Boundary markers: The skill does not define specific delimiters or instructional wrappers to separate the API-returned data from the agent's internal logic.
- Capability inventory: The skill utilizes
requests.postfor data retrieval and search operations as shown inSKILL.md. - Sanitization: No explicit sanitization or filtering logic is specified for the ingested content.
Audit Metadata