specs-liquor-prices
Pass
Audited by Gen Agent Trust Hub on Oct 31, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill provides instructions to install the
scavioSDK for Python and Node.js, and usesnpxto run the@scavio/mcp-serverpackage from standard package registries. - [COMMAND_EXECUTION]: Documentation includes
bashexamples for installing dependencies and making API requests usingcurl. - [INDIRECT_PROMPT_INJECTION]: The skill processes structured and unstructured data (e.g., product names, tasting notes, and descriptions) from an external API, which could potentially serve as a vector for instructions that influence the agent's behavior.
- Ingestion points: Data retrieved from
api.scavio.devis incorporated into the agent's context during search and product lookup workflows. - Boundary markers: The instructions do not define explicit delimiters or warnings to separate external data from system instructions.
- Capability inventory: The skill utilizes network communication tools including
curl, therequestslibrary, and specialized vendor SDKs. - Sanitization: There is no mention of sanitizing or filtering the content fetched from the API before it is presented to or processed by the agent.
Audit Metadata