skills/scavio-ai/skills/scavio/Gen Agent Trust Hub

scavio

Pass

Audited by Gen Agent Trust Hub on Nov 14, 2026

Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
  • [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest data from 78 external platforms, including social media posts, product reviews, and web pages.
  • Ingestion points: Data enters the agent context through the Scavio API (api.scavio.dev) across all reference files and instructions.
  • Boundary markers: The instructions do not explicitly mandate the use of delimiters or 'ignore instructions' warnings when the agent processes the retrieved external content.
  • Capability inventory: The skill provides examples of network operations (curl, requests.post) and package execution (npx).
  • Sanitization: There are no documented procedures for sanitizing or escaping the retrieved external content before it is processed by the agent.
  • [EXTERNAL_DOWNLOADS]: The skill facilitates the download and execution of the vendor's own packages and CLI tools.
  • Instructions recommend running npx -y scavio@0.39.2 login to manage API keys.
  • Documentation points to the scavio package on PyPI and npm for integration.
  • [COMMAND_EXECUTION]: The skill provides various shell command examples (curl) for interacting with the API and managing credentials via the Scavio CLI.
Audit Metadata
Risk Level
SAFE
Analyzed
Nov 14, 2026, 06:34 PM