walmart-product-data
Pass
Audited by Gen Agent Trust Hub on Sep 3, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from an external source (Walmart product details and reviews), which constitutes a vulnerability surface where adversarial instructions could be embedded to influence the agent's behavior.
- Ingestion points: External data enters the agent context via multiple API endpoints hosted at
api.scavio.dev(e.g.,/api/v1/walmart/search,/api/v1/walmart/product, and/api/v1/walmart/reviews). - Boundary markers: There are no explicit instructions or delimiters defined to isolate the retrieved content or to warn the agent against executing embedded instructions.
- Capability inventory: The skill facilitates the retrieval of structured JSON containing user-generated content (reviews) and marketing copy (product descriptions).
- Sanitization: The skill documentation does not outline any specific sanitization or validation logic applied to the data retrieved from the Walmart marketplace before it is processed by the agent.
Audit Metadata