rightmove-property-data
Pass
Audited by Gen Agent Trust Hub on Oct 12, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill instructions specify the installation of the
scaviolibrary from PyPI and npm. These are official packages maintained by the skill author for API interaction. - [REMOTE_CODE_EXECUTION]: The documentation provides an
npxcommand to run the Scavio MCP server (@scavio/mcp-server). This is a verified distribution method for the vendor's agent tools. - [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process property listing data from Rightmove, which is an external and untrusted source of text.
- Ingestion points: Property descriptions, key features, and summaries retrieved through the
/searchand/propertyendpoints as documented inSKILL.md. - Boundary markers: No explicit instructions are provided to the agent to treat listing content as untrusted data or to use specific delimiters.
- Capability inventory: The skill has the capability to perform network requests to
api.scavio.devand execute shell commands via the MCP server integration. - Sanitization: There is no mention of sanitizing or escaping the retrieved property data before it is processed by the agent.
Audit Metadata