Skills
Navigate
skills/scavio-ai/skills/menards-product-data/Gen Agent Trust Hub

menards-product-data

Pass

Audited by Gen Agent Trust Hub on Nov 7, 2026

Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
  • [INDIRECT_PROMPT_INJECTION]: The skill retrieves product details, specifications, and bullet points from Menards.com via the Scavio API. This third-party data is untrusted and could potentially contain malicious instructions intended to influence agent behavior.
  • Ingestion points: JSON responses from https://api.scavio.dev/api/v1/menards/search and /product endpoints are loaded into the agent's context (SKILL.md).
  • Boundary markers: The skill does not specify the use of delimiters or 'ignore' instructions when processing retrieved retail data.
  • Capability inventory: The skill includes capabilities for network communication and file/data processing via vendor-provided tools.
  • Sanitization: No explicit sanitization or filtering of the retail data is described in the skill instructions.
  • [EXTERNAL_DOWNLOADS]: The documentation recommends installing the scavio library for Python and Node.js, and an MCP server (@scavio/mcp-server), which are official packages provided by the skill author.
  • [COMMAND_EXECUTION]: The skill provides instructional examples using curl and npx to interact with the API and launch the vendor's MCP server.
Audit Metadata
Risk Level
SAFE
Analyzed
Nov 7, 2026, 08:05 PM