mpstats

Pass

Audited by Gen Agent Trust Hub on Sep 14, 2026

Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [COMMAND_EXECUTION]: The skill relies on a suite of Bash scripts to interact with marketplace APIs. These scripts utilize standard system utilities such as curl, jq, python3, and node to process requests and format data. This is the intended operational mechanic for the skill.
  • [INDIRECT_PROMPT_INJECTION]: The skill processes external marketplace data, including product descriptions and review text, which could theoretically contain malicious instructions (Indirect Prompt Injection surface). The skill explicitly mitigates this risk by providing 'Sanity check' guidelines in SKILL.md that instruct the agent to validate data, compare it against category medians, and flag anomalies before presenting results to the user.
  • [EXTERNAL_DOWNLOADS]: The script wb-card-content.sh retrieves product metadata directly from the Wildberries content delivery network (wbbasket.ru). This is a legitimate functional requirement for retrieving detailed product characteristics and card content not available via the primary MPSTATS analytics API. Other scripts interact exclusively with the official vendor domain mpstats.io.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 14, 2026, 04:25 PM