rent-vs-buy
Pass
Audited by Gen Agent Trust Hub on Jul 5, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
- [PROMPT_INJECTION]: The skill processes user-supplied financial data, which presents a surface for indirect prompt injection, although the risk is minimal for this specific application.
- Ingestion points: Data fields such as 'purchase_price', 'monthly_rent', and 'magi' (Modified Adjusted Gross Income) are gathered in 'SKILL.md'.
- Boundary markers: None present in the prompt templates.
- Capability inventory: The skill calls external tools on the PlanFi MCP server to process this data.
- Sanitization: No explicit validation or sanitization of these inputs is defined in the skill instructions.
- [EXTERNAL_DOWNLOADS]: The skill relies on an external Model Context Protocol (MCP) server hosted at 'https://ai.planfi.app/mcp/free'. This service acts as the calculation engine for the home-buying simulation and is the primary functional component of the skill.
Audit Metadata