zillow-property-data
Pass
Audited by Gen Agent Trust Hub on Sep 3, 2026
Risk Level: SAFE
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill instructs users to install the
scaviopackage via standard package managers (pipandnpm). These are versioned releases (0.15.0) of the official library provided by the skill vendor. - [COMMAND_EXECUTION]: The skill provides code examples for making HTTP POST requests using the
requestslibrary in Python and thescavioSDK. These operations are limited to communicating with the vendor's API atapi.scavio.devand do not involve arbitrary shell command execution. - [CREDENTIALS_UNSAFE]: The documentation follows secure practices by instructing users to store their API key (
SCAVIO_API_KEY) in an environment variable rather than hardcoding it. Code examples use clearly labeled placeholders likesk_your_key_here. - [INDIRECT_PROMPT_INJECTION]: The skill retrieves property descriptions and agent reviews from Zillow via the Scavio API. While this involves processing untrusted external text, the skill is primarily data-focused and does not expose high-risk capabilities like local file writes or system command execution that could be targeted by embedded instructions.
Audit Metadata