lowes-product-data
Pass
Audited by Gen Agent Trust Hub on Oct 31, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to fetch and process external data from Lowe's, including product descriptions and customer reviews. Because this content is generated by third parties, it could contain malicious instructions or patterns intended to influence the agent's execution.
- Ingestion points: External data enters the agent context through the
lowes/search,lowes/product, andlowes/reviewsAPI endpoints described inSKILL.md. - Boundary markers: While the skill includes a "Guardrails" section that provides logic for interpreting data and instructions to avoid fabrication, it does not define clear technical delimiters or escape sequences to separate untrusted external content from the agent's primary instructions.
- Capability inventory: The skill enables network operations via the Scavio API (implemented in the Python example using the
requestslibrary) and is compatible with agent frameworks that may have file or shell access. - Sanitization: There is no evidence of sanitization or content filtering applied to the API responses before they are presented to the AI agent.
Audit Metadata