target-product-data
Pass
Audited by Gen Agent Trust Hub on Nov 7, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: No malicious patterns, such as prompt injection, persistence, or privilege escalation, were identified. The skill's structure and instructions are consistent with its stated purpose.
- [EXTERNAL_DOWNLOADS]: The skill performs HTTP POST requests to
api.scavio.dev, which is the official API endpoint for the vendor, scavio-ai. These operations are essential for retrieving the product data requested by the user and do not involve untrusted third-party sources. - [CREDENTIALS_UNSAFE]: The skill demonstrates secure secret management by instructing users to store their API key in the
SCAVIO_API_KEYenvironment variable. It explicitly recommends keeping keys out of source control in the provided code examples. - [INDIRECT_PROMPT_INJECTION]: The skill includes explicit guardrails to prevent the agent from being influenced by external data, such as instructions to 'Never fabricate product names, prices, TCINs, ratings or review text' and to 'Only return data the API returned'. These measures mitigate the risk associated with processing external content.
Audit Metadata