ikea-api
Pass
Audited by Gen Agent Trust Hub on Nov 13, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process data from external IKEA market sites via the Scavio API, including product descriptions and user reviews.
- Ingestion points: Data is retrieved from various endpoints on
api.scavio.devas detailed inSKILL.md. - Boundary markers: The instructions include a requirement to "Quote names and labels as returned," which serves as a basic delimiter for untrusted content.
- Capability inventory: The skill does not possess high-privilege capabilities such as arbitrary command execution or file system write access.
- Sanitization: The instructions do not specify any explicit sanitization or validation of the fetched API content.
- [EXTERNAL_DOWNLOADS]: The documentation provides installation commands for the official Scavio SDKs and MCP server.
- Evidence: The skill references
scavioon PyPI and NPM, and@scavio/mcp-serveron NPM. These are identified as legitimate resources associated with the skill's vendor.
Audit Metadata