skills/scavio-ai/skills/ikea-api/Gen Agent Trust Hub

ikea-api

Pass

Audited by Gen Agent Trust Hub on Nov 13, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
  • [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process data from external IKEA market sites via the Scavio API, including product descriptions and user reviews.
  • Ingestion points: Data is retrieved from various endpoints on api.scavio.dev as detailed in SKILL.md.
  • Boundary markers: The instructions include a requirement to "Quote names and labels as returned," which serves as a basic delimiter for untrusted content.
  • Capability inventory: The skill does not possess high-privilege capabilities such as arbitrary command execution or file system write access.
  • Sanitization: The instructions do not specify any explicit sanitization or validation of the fetched API content.
  • [EXTERNAL_DOWNLOADS]: The documentation provides installation commands for the official Scavio SDKs and MCP server.
  • Evidence: The skill references scavio on PyPI and NPM, and @scavio/mcp-server on NPM. These are identified as legitimate resources associated with the skill's vendor.
Audit Metadata
Risk Level
SAFE
Analyzed
Nov 13, 2026, 06:44 PM