yield-intelligence
Warn
Audited by Gen Agent Trust Hub on Aug 15, 2026
Risk Level: MEDIUMEXTERNAL_DOWNLOADSDATA_EXFILTRATION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill instructs the user to configure an external MCP server endpoint (
https://api.intuitek.ai/yield/mcp) to enable its core functionality. This endpoint resides on a domain that does not match the skill author's known infrastructure. - [DATA_EXPOSURE]: The workflow requires users to input sensitive financial parameters, including available capital, target monthly income, and account types (Taxable/IRA). This data is subsequently transmitted to the external
api.intuitek.aiendpoint during tool execution. - [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted user input for financial planning which is then used as arguments for external tool calls.
- Ingestion points: User-provided parameters in Step 1 (Capital, Income, Risk, Account Type).
- Boundary markers: None present; the instructions do not include delimiters or warnings to ignore embedded instructions in user data.
- Capability inventory: Uses
analyze_yield_opportunitiesandoptimize_income_portfoliotools via the remote MCP server. - Sanitization: No evidence of input validation or sanitization before passing user data to the MCP tools.
Audit Metadata