singtel
Pass
Audited by Gen Agent Trust Hub on Oct 7, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONDYNAMIC_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes live content from singtel.com, which introduces a surface for indirect prompt injection attacks if the ingested content contains adversarial instructions.
- Ingestion points: Data is ingested through tools like shop_singtel_com__get_plans, shop_singtel_com__read_page, and unbrowse.run.
- Boundary markers: The skill lacks explicit instructions or delimiters to isolate untrusted web data.
- Capability inventory: The agent can perform reads and simulated browser actions on the target site.
- Sanitization: Sanitization is handled by the vendor's remote infrastructure.
- [EXTERNAL_DOWNLOADS]: The installation and setup instructions involve downloading components from the vendor's domain.
- Evidence: npx skills add https://unbrowse.ai and usage of the remote MCP endpoint.
- [REMOTE_CODE_EXECUTION]: Core tool logic is executed on a remote vendor-hosted MCP server rather than locally.
- Evidence: server.json specifies a streamable-http remote at https://unbrowse.ai/mcp/singtel.com.
- [DYNAMIC_EXECUTION]: The skill features tools like unbrowse.run and unbrowse.browse.act that dynamically generate actions or execute tasks on singtel.com at runtime.
- Evidence: These tools are documented in SKILL.md as methods for executing tasks in plain words or performing multi-step browser interactions.
Audit Metadata