yandex-market-mcp
Pass
Audited by Gen Agent Trust Hub on Sep 11, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill provides instructions to download and install the
yandex-market-mcp-rupackage directly from the author's GitHub repository (github.com/ilyautov/yandex-market-mcp-ru) using theuvxtool. - [REMOTE_CODE_EXECUTION]: The installation process involves executing code retrieved from a remote Git repository to set up the MCP server environment.
- [INDIRECT_PROMPT_INJECTION]: The skill interacts with the Yandex Market API, processing external data such as catalog information and order details.
- Ingestion points: Data enters the context via the
ym_call_methodtool which fetches live data from Yandex Market. - Boundary markers: The skill includes explicit instructions for the agent to show the request body to the user and wait for confirmation before performing any write operations.
- Capability inventory: The skill can search, describe, and call API methods, which includes both read and write capabilities (e.g., changing prices or managing orders).
- Sanitization: The instructions advise the agent not to round or recalculate numbers and to report empty lists accurately, ensuring data integrity.
- [CREDENTIALS_UNSAFE]: The skill requires a
YANDEX_MARKET_API_KEY. It instructs users to provide this via environment variables or a local configuration file (~/.marketplace-mcp/cabinets.json). It uses a placeholder<значение>and does not contain hardcoded secrets.
Audit Metadata