mpstats
Pass
Audited by Gen Agent Trust Hub on Sep 14, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill relies on a suite of Bash scripts to interact with marketplace APIs. These scripts utilize standard system utilities such as
curl,jq,python3, andnodeto process requests and format data. This is the intended operational mechanic for the skill. - [INDIRECT_PROMPT_INJECTION]: The skill processes external marketplace data, including product descriptions and review text, which could theoretically contain malicious instructions (Indirect Prompt Injection surface). The skill explicitly mitigates this risk by providing 'Sanity check' guidelines in
SKILL.mdthat instruct the agent to validate data, compare it against category medians, and flag anomalies before presenting results to the user. - [EXTERNAL_DOWNLOADS]: The script
wb-card-content.shretrieves product metadata directly from the Wildberries content delivery network (wbbasket.ru). This is a legitimate functional requirement for retrieving detailed product characteristics and card content not available via the primary MPSTATS analytics API. Other scripts interact exclusively with the official vendor domainmpstats.io.
Audit Metadata