skills/sepehr071/iran-mcp/tapsifood/Gen Agent Trust Hub

tapsifood

Pass

Audited by Gen Agent Trust Hub on Oct 24, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill instructions direct the user to install the tapsifood-mcp package from a public registry via the uvx command. This package is external to the skill and required for its tools to function.
  • [INDIRECT_PROMPT_INJECTION]: The skill tools ingest data from external Tapsi Food APIs, including user reviews and restaurant information, which could contain malicious instructions meant to influence the agent. 1. Ingestion points: External data is retrieved through tools such as tf_reviews, tf_menu, and tf_search_dishes. 2. Boundary markers: The instructions do not specify any delimiters or safety warnings to help the agent distinguish between data and instructions. 3. Capability inventory: The skill tools are designed for read-only information retrieval. 4. Sanitization: There is no indication of content sanitization or validation for the data returned by the external APIs.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 24, 2026, 05:31 AM