skills/sepehr071/iran-mcp/iran-news/Gen Agent Trust Hub

iran-news

Pass

Audited by Gen Agent Trust Hub on Oct 24, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTIONNO_CODE
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill instructions advise users to install the iran-news-mcp package from a public registry using uvx. This external dependency is necessary for the provided news tools to function.\n- [INDIRECT_PROMPT_INJECTION]: The skill ingests and processes untrusted content from external Iranian news websites, creating a potential surface for indirect prompt injection where malicious instructions could be embedded in fetched articles.\n
  • Ingestion points: Tools such as nw_article and nw_latest fetch full body text, headlines, and summaries from sources like mehrnews.com, tabnak.ir, and entekhab.ir.\n
  • Boundary markers: There are no specific delimiters or instructions provided to the agent to treat fetched news content as data only or to ignore embedded instructions.\n
  • Capability inventory: The skill leverages network-based tools to retrieve external content for processing and display.\n
  • Sanitization: The skill does not define any sanitization, filtering, or validation steps for the content retrieved from external sites.\n- [NO_CODE]: The skill definition serves as a configuration and instruction set; it does not contain the executable code for the news tools, which is instead hosted in the external iran-news-mcp package.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 24, 2026, 05:31 AM