restaurant-local-buzz
Pass
Audited by Gen Agent Trust Hub on Jul 3, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The documentation references connecting to the UnifAPI MCP server at
https://mcp.unifapi.comand adding skills fromunifapi-agent/agents. These resources are provided by the skill's author to facilitate the tool's data-driven marketing analysis. - [COMMAND_EXECUTION]: The installation guide in the README involves the use of
npx skills add, which requires the user to execute shell commands to configure the marketing agent tools. - [PROMPT_INJECTION]: The skill processes untrusted external data, which creates a surface for indirect prompt injection.
- Ingestion points: The skill retrieves review text from local map search results and diner comments from TikTok clips using the
unifapitools. - Boundary markers: No explicit markers or instructions are provided to separate fetched data from the agent's instructions or to treat the data as potentially adversarial.
- Capability inventory: The agent's available tools are restricted to search and retrieval functions within the UnifAPI ecosystem. It does not have access to sensitive system commands, file writing, or unconstrained network access.
- Sanitization: There is no description of sanitization or validation processes for the data fetched from external social and local platforms.
Audit Metadata