specs-liquor-prices

Pass

Audited by Gen Agent Trust Hub on Oct 31, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill provides instructions to install the scavio SDK for Python and Node.js, and uses npx to run the @scavio/mcp-server package from standard package registries.
  • [COMMAND_EXECUTION]: Documentation includes bash examples for installing dependencies and making API requests using curl.
  • [INDIRECT_PROMPT_INJECTION]: The skill processes structured and unstructured data (e.g., product names, tasting notes, and descriptions) from an external API, which could potentially serve as a vector for instructions that influence the agent's behavior.
  • Ingestion points: Data retrieved from api.scavio.dev is incorporated into the agent's context during search and product lookup workflows.
  • Boundary markers: The instructions do not define explicit delimiters or warnings to separate external data from system instructions.
  • Capability inventory: The skill utilizes network communication tools including curl, the requests library, and specialized vendor SDKs.
  • Sanitization: There is no mention of sanitizing or filtering the content fetched from the API before it is presented to or processed by the agent.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 31, 2026, 03:43 PM