ev-lending-risk-monitor
Pass
Audited by Gen Agent Trust Hub on Apr 29, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill follows its stated purpose of providing EV market intelligence without any detectable malicious patterns.
- [COMMAND_EXECUTION]: The skill uses Marketcheck's own MCP tools (
mcp__marketcheck__get_sold_summaryandmcp__marketcheck__search_active_cars) to retrieve market data. These operations are scoped to the vendor's functionality and do not involve arbitrary shell command execution. - [DATA_EXPOSURE_&_EXFILTRATION]: The skill references a project memory file (
marketcheck-profile.md) to extract user preferences such as target states and country. This is a standard practice for personalizing agent responses and does not constitute unauthorized data exposure. - [INDIRECT_PROMPT_INJECTION]: While the skill processes external data from market APIs, it employs strict data extraction logic, pulling only specific numeric and categorical fields (e.g.,
sold_count,average_sale_price,make,model). This targeted extraction significantly mitigates the risk of indirect prompt injection from the processed data source.
Audit Metadata