sams-club-product-data
Pass
Audited by Gen Agent Trust Hub on Nov 14, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill retrieves and processes untrusted data from an external API, including product titles, descriptions, and member reviews, creating a potential surface for indirect prompt injection attacks. 1. Ingestion points: Data enters the agent context through the /search, /product, and /reviews endpoints. 2. Boundary markers: The skill includes high-level behavioral guardrails for data accuracy but lacks explicit structural delimiters to isolate external text within the agent's prompt. 3. Capability inventory: The skill performs network requests to api.scavio.dev and processes the resulting JSON data. 4. Sanitization: No specific filtering or sanitization of the retrieved external text is defined in the instructions.
- [EXTERNAL_DOWNLOADS]: The skill documentation directs the user to install external libraries and tools from the vendor. 1. Dependencies: Includes instructions to install the scavio package (pip/npm) and the @scavio/mcp-server tool. 2. Source: These resources are provided via official public package registries.
Audit Metadata