pasavard
Pass
Audited by Gen Agent Trust Hub on Oct 24, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill fetches product descriptions, prices, and ranking information from an external API (pasavard.ir), which could potentially contain malicious content that influences the agent's behavior.
- Ingestion points: Data retrieved via the search_products, best_lists, and best_list tools.
- Boundary markers: No explicit markers are used to separate external data from system instructions.
- Capability inventory: The skill tools are read-only and do not possess file-writing, network-sending, or command-execution capabilities.
- Sanitization: No sanitization of the remote API content is indicated in the documentation.
- [EXTERNAL_DOWNLOADS]: The skill requires connecting to a remote Model Context Protocol (MCP) server hosted at https://pasavard.ir/api/mcp to provide its functionality.
Audit Metadata