dealer-match-finder
Pass
Audited by Gen Agent Trust Hub on Apr 29, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: No malicious patterns, obfuscation, or unauthorized network operations were detected. The skill's behavior is consistent with its stated purpose of dealership prospecting using vendor-provided tools.
- [DATA_EXPOSURE]: The skill references a configuration file named
marketcheck-profile.mdto load user-specific parameters like target states and price ranges. This is used for personalizing the search and does not involve accessing sensitive system credentials or private keys. - [INDIRECT_PROMPT_INJECTION]: The skill ingests data from external sources (MarketCheck API) to calculate dealer scores and talking points. While this represents an attack surface for indirect injection, the risk is minimal as the data is sourced from a trusted vendor API and used solely to generate informational output.
- Ingestion points:
marketcheck-profile.md(local config),mcp__marketcheck__*tool outputs (external API). - Boundary markers: Absent; the skill does not use specific delimiters to separate tool output from instructions.
- Capability inventory: Use of
mcp__marketcheck__search_active_cars,mcp__marketcheck__get_sold_summary, andmcp__marketcheck__search_uk_active_carstools. No file-write, subprocess, or arbitrary execution capabilities. - Sanitization: Absent; the skill relies on the structured nature of the API response.
Audit Metadata