pricing-strategy
Pass
Audited by Gen Agent Trust Hub on Sep 22, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [SAFE]: The skill utilizes vendor-specific MCP tools (
mcp__dataforseo__merchant_amazon_asin_live_advancedandmcp__dataforseo__merchant_amazon_sellers_live_advanced) to interact with the DataForSEO API. This is standard vendor functionality for a specialized merchant tool. - [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from external sources, including Amazon product titles, seller names, and delivery messages. The provided evidence chain includes: (1) Ingestion Points: Data fetched from
mcp__dataforseo__merchant_amazon_asin_live_advancedandmcp__dataforseo__merchant_amazon_sellers_live_advanced; (2) Boundary Markers: No explicit delimiters or warnings are present in the skill's instructions; (3) Capability Inventory: The skill executes specific tool calls and outputs formatted reports to chat; (4) Sanitization: No explicit sanitization of external product content is documented. However, the risk is assessed as low because the skill's current scope is limited to displaying information rather than executing derived commands. - [SAFE]: The skill implements a 'preflight' connection check (
Step 0) that verifies tool availability and credential health before conducting analysis, following standard best practices for reliable API interaction.
Audit Metadata