government-tender-leads
Pass
Audited by Gen Agent Trust Hub on Sep 7, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill provides a link to a Model Context Protocol (MCP) server at
https://mcp.manypi.com/mcp. This resource is hosted on the official domain of the skill vendor ('manypicom'). - [COMMAND_EXECUTION]: The instructions include a bash command intended to integrate the ManyPI lead generation tool into the agent's environment:
claude mcp add --transport http manypi https://mcp.manypi.com/mcp -s user. - [INDIRECT_PROMPT_INJECTION]: The skill processes data from external procurement portals, creating a potential ingestion surface.
- Ingestion points: External national procurement portals and contract award notices as defined in the 'ManyPI brief' section.
- Boundary markers: The instructions do not specify explicit delimiters or boundary markers for the data being ingested.
- Capability inventory: The skill captures lead information including contact details and URLs from external public records.
- Sanitization: There are no mentioned mechanisms for sanitizing or validating the content retrieved from these external notices.
Audit Metadata