mcp-brasil-public-apis

Pass

Audited by Gen Agent Trust Hub on Mar 27, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
  • [PROMPT_INJECTION]: The skill presents a surface for indirect prompt injection by ingesting data from 28 external Brazilian public APIs (such as IBGE, Bacen, and Câmara). Although the skill uses Pydantic schemas for data validation as seen in schemas.py, it does not implement explicit boundary markers or instructions to disregard potential commands embedded within the external data. The skill possesses capabilities to perform network requests and tool execution.
  • [EXTERNAL_DOWNLOADS]: The skill requires the installation of the mcp-brasil package from public registries using pip or uv. It also references its source code repository on GitHub for development purposes.
  • [COMMAND_EXECUTION]: The server is executed through shell commands such as uvx and fastmcp. Additionally, the skill includes a Makefile that facilitates various development actions, including testing, linting, and running the server environment.
Audit Metadata
Risk Level
SAFE
Analyzed
Mar 27, 2026, 03:12 AM