mcp-brasil-server
Pass
Audited by Gen Agent Trust Hub on Sep 16, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill utilizes the mcp-brasil package from the official Python Package Index (PyPI). It also fetches large, publicly available datasets from Brazilian government sources to populate a local DuckDB cache for high-performance querying.\n- [INDIRECT_PROMPT_INJECTION]: The skill acts as an interface for a wide array of external data sources (70+ Brazilian government APIs). While these are official sources, the ingestion of external text content represents an inherent attack surface for indirect prompt injection.\n
- Ingestion points: API responses from domains such as portaldatransparencia.gov.br, dados.gov.br, and others in the SKILL.md file.\n
- Boundary markers: Not explicitly mentioned in the skill definition.\n
- Capability inventory: Network data retrieval, SQL querying via DuckDB, and batch tool execution.\n
- Sanitization: Standard HTTP client handling is mentioned; further content sanitization is not detailed.\n- [DYNAMIC_EXECUTION]: Provides capabilities for executing dynamic SQL queries against local DuckDB datasets (e.g., anp_precos_query, inep_censo_query). This is an intended feature for data analysis using the agent's logic.
Audit Metadata