yelp-business-data
Pass
Audited by Gen Agent Trust Hub on Oct 12, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [SAFE]: The skill provides instructions and examples for interacting with the API at api.scavio.dev to perform business searches and retrieve reviews. The network activity is consistent with the skill's stated purpose.\n- [SAFE]: The skill emphasizes secure credential management by instructing users to store the API key in an environment variable rather than hardcoding it into scripts.\n- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted third-party data in the form of business reviews and descriptions, which represents an indirect prompt injection surface.\n
- Ingestion points: Data is ingested through the /yelp/search, /yelp/business, and /yelp/reviews endpoints in SKILL.md.\n
- Boundary markers: Absent; there are no specific instructions for the agent to use delimiters or markers to isolate the fetched content.\n
- Capability inventory: The skill utilizes network capabilities to communicate with api.scavio.dev.\n
- Sanitization: Absent; the skill does not specify any sanitization or filtering logic for the retrieved review text.
Audit Metadata