home-depot-product-data
Pass
Audited by Gen Agent Trust Hub on Sep 3, 2026
Risk Level: SAFECREDENTIALS_UNSAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [CREDENTIALS_SAFE]: The skill provides instructions on using environment variables (
SCAVIO_API_KEY) to manage secrets, which is a security best practice. It uses placeholders in example code and explicitly advises against committing keys to source control. - [EXTERNAL_DOWNLOADS]: The skill references official SDKs for Python (
scavio) and Node.js (scavio). These are vendor-owned packages intended for interacting with the service. - [INDIRECT_PROMPT_INJECTION]: The skill ingests external data including product descriptions and customer reviews from Home Depot. While this represents a data ingestion surface, the skill does not provide dangerous capabilities that would facilitate exploitation.
- [SAFE]: All network requests are directed to the vendor's API endpoints (
api.scavio.dev), representing standard and expected functionality for this service.
Audit Metadata