zillow-property-data

Pass

Audited by Gen Agent Trust Hub on Sep 3, 2026

Risk Level: SAFE
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill instructs users to install the scavio package via standard package managers (pip and npm). These are versioned releases (0.15.0) of the official library provided by the skill vendor.
  • [COMMAND_EXECUTION]: The skill provides code examples for making HTTP POST requests using the requests library in Python and the scavio SDK. These operations are limited to communicating with the vendor's API at api.scavio.dev and do not involve arbitrary shell command execution.
  • [CREDENTIALS_UNSAFE]: The documentation follows secure practices by instructing users to store their API key (SCAVIO_API_KEY) in an environment variable rather than hardcoding it. Code examples use clearly labeled placeholders like sk_your_key_here.
  • [INDIRECT_PROMPT_INJECTION]: The skill retrieves property descriptions and agent reviews from Zillow via the Scavio API. While this involves processing untrusted external text, the skill is primarily data-focused and does not expose high-risk capabilities like local file writes or system command execution that could be targeted by embedded instructions.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 3, 2026, 12:23 PM
Security Audit — agent-trust-hub — zillow-property-data