maisons-du-monde-api
Pass
Audited by Gen Agent Trust Hub on Nov 14, 2026
Risk Level: SAFE
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill references official SDKs for Python (
scavio==0.59.0) and Node.js (scavio@0.60.0), as well as an MCP server (@scavio/mcp-server@0.57.0). These are official packages provided by the vendor, scavio-ai, and are used for the intended purpose of the skill. - [COMMAND_EXECUTION]: The documentation includes standard setup commands for exporting environment variables and installing packages via
pip,npm, andnpx. These are common developer setup instructions and do not contain malicious payloads. - [CREDENTIALS_UNSAFE]: The skill correctly instructs the user to store their API key in an environment variable (
SCAVIO_API_KEY) and provides safe placeholders (e.g.,sk_your_key_here) for demonstration purposes, which is a recommended security practice for secret management. - [INDIRECT_PROMPT_INJECTION]: The skill ingests data from the Maisons du Monde site (via the scavio.dev API), including product descriptions and customer reviews. While this represents a standard attack surface for indirect prompt injection, the skill includes notes about sanitization performed by the API (e.g., removing emails from reviews) and instructs the agent to differentiate its own words from the retrieved data, effectively managing this risk.
Audit Metadata