yahoo
Pass
Audited by Gen Agent Trust Hub on Sep 28, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from external Yahoo-affiliated websites via search and page-reading tools such as currently_att_yahoo_com__get_yhs_search and tech_yahoo_com__read_page. • Ingestion points: Data is retrieved from external URLs and search results as described in SKILL.md. • Boundary markers: No explicit delimiters or instructions are provided to the agent to distinguish between tool results and potential embedded instructions. • Capability inventory: The skill performs network operations to the Unbrowse proxy service. • Sanitization: There is no evidence of sanitization or filtering of the retrieved web content before it is processed by the agent.
- [EXTERNAL_DOWNLOADS]: The skill is configured to connect to a remote Model Context Protocol (MCP) server hosted at https://unbrowse.ai/mcp/yahoo.com for its primary tool logic and execution, as specified in the server.json remotes configuration.
Audit Metadata