orf-at
Pass
Audited by Gen Agent Trust Hub on Sep 28, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill utilizes a remote Model Context Protocol (MCP) server located at
https://unbrowse.ai/mcp/orf.at. This means that tool execution and data processing occur on the service provider's infrastructure. Additionally, the skill instructions suggest installation vianpx skills add https://unbrowse.ai, which fetches configuration from the vendor's domain. - [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process untrusted data from external web pages (orf.at).
- Ingestion points: Data is retrieved via
orf_at__read_page,orf_at__get_nsr_get_front_page_video, and weather tools. - Boundary markers: There are no explicit instructions provided to the agent to use delimiters or 'ignore' blocks when processing the fetched content.
- Capability inventory: The skill has network access capabilities via the configured remote MCP endpoint.
- Sanitization: The skill relies on the remote server to extract 'readable text' and links from the target site before returning it to the agent.
Audit Metadata