attorney-reputation-benchmark
Pass
Audited by Gen Agent Trust Hub on Jul 3, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill requires the installation of the 'unifapi' plugin and MCP server from the vendor's infrastructure at 'unifapi.com'. These are documented as official resources from the skill author ('unifapi-agent') and provide the core data fetching capabilities.
- [PROMPT_INJECTION]: The skill possesses an indirect prompt injection surface as it ingests and processes untrusted public review text from external sources.
- Ingestion points: Public review text and listing descriptions are retrieved via 'local/search' and 'maps/search' operations.
- Boundary markers: The instructions do not include specific delimiters or 'ignore' commands to prevent the agent from following instructions that might be embedded in the retrieved public reviews.
- Capability inventory: The skill's permissions are restricted to read-only tool calls for marketing metrics. It lacks the ability to write to the file system, execute shell commands, or perform arbitrary network operations beyond the defined tool set.
- Sanitization: No explicit sanitization or filtering is performed on the ingested public data before it is processed by the agent.
Audit Metadata