dealer-match-finder

Pass

Audited by Gen Agent Trust Hub on Apr 29, 2026

Risk Level: SAFE
Full Analysis
  • [SAFE]: No malicious patterns, obfuscation, or unauthorized network operations were detected. The skill's behavior is consistent with its stated purpose of dealership prospecting using vendor-provided tools.
  • [DATA_EXPOSURE]: The skill references a configuration file named marketcheck-profile.md to load user-specific parameters like target states and price ranges. This is used for personalizing the search and does not involve accessing sensitive system credentials or private keys.
  • [INDIRECT_PROMPT_INJECTION]: The skill ingests data from external sources (MarketCheck API) to calculate dealer scores and talking points. While this represents an attack surface for indirect injection, the risk is minimal as the data is sourced from a trusted vendor API and used solely to generate informational output.
  • Ingestion points: marketcheck-profile.md (local config), mcp__marketcheck__* tool outputs (external API).
  • Boundary markers: Absent; the skill does not use specific delimiters to separate tool output from instructions.
  • Capability inventory: Use of mcp__marketcheck__search_active_cars, mcp__marketcheck__get_sold_summary, and mcp__marketcheck__search_uk_active_cars tools. No file-write, subprocess, or arbitrary execution capabilities.
  • Sanitization: Absent; the skill relies on the structured nature of the API response.
Audit Metadata
Risk Level
SAFE
Analyzed
Apr 29, 2026, 02:40 AM
Security Audit — agent-trust-hub — dealer-match-finder