steam-market-research
Pass
Audited by Gen Agent Trust Hub on Nov 6, 2026
Risk Level: SAFE
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill makes requests to official Steam Store APIs (steampowered.com) to fetch public game metadata and player statistics. These are standard operations for market research.
- [INDIRECT_PROMPT_INJECTION]: The skill ingests data from external Steam API responses. While this represents a theoretical attack surface where a malicious game description could contain instructions, the skill uses these for data aggregation and research summaries, which is a standard use case with low risk.
- [REMOTE_CODE_EXECUTION]: The skill mentions an optional MCP server hosted at github.com/TMHSDigital/steam-mcp. This is a resource owned by the skill's author (tmhsdigital) and is intended for extending the agent's capabilities via the MCP framework rather than arbitrary code execution.
- [COMMAND_EXECUTION]: The skill provides example
curl.execommands for the agent to use. These commands are directed at legitimate Steam API endpoints and do not involve sensitive local file access or dangerous shell operations.
Audit Metadata