agent-reputation-benchmark
Pass
Audited by Gen Agent Trust Hub on Jul 2, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill uses an external MCP server located at https://mcp.unifapi.com. It also recommends installation via 'npx skills add unifapi-agent/agents'. These resources are associated with the vendor's official domain and represent standard functional requirements for the skill.
- [PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it ingests and analyzes untrusted data from public real estate listings and user reviews.
- Ingestion points: Public review text and business listing metadata retrieved from 'local/search' and 'maps/search' tools in the SKILL.md file.
- Boundary markers: The instructions lack explicit delimiters or instructions for the agent to ignore potentially malicious content within the ingested review text.
- Capability inventory: The skill is configured for read-only operations and does not possess capabilities for file writing, system command execution, or network exfiltration.
- Sanitization: There is no evidence of filtering or sanitization applied to the external review content before it is processed by the agent.
Audit Metadata