Security audit
Security checks for vulnerabilities and agentic risk
This skill is a disclosed paid MCP integration for product price comps, with no local code execution or hidden system access found.
Before installing, confirm you are comfortable with a third-party MCP server receiving your product queries, logging each call, and charging $0.05 per paid x402 call on capable clients. Treat results marked data_type "active" as asking-price comps, not confirmed sale prices.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
{
"mcpServers": {
"sold-price-comps": {
"url": "https://api.3rdplaceprovisions.com/mcp"
}
}
}
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
{
"mcpServers": {
"sold-price-comps": {
"url": "https://api.3rdplaceprovisions.com/mcp"
}
}
}
The skill discloses paid usage and server-side logging only later in the document, not prominently at the point users decide to install or invoke it. In an agent setting, this can cause users or downstream agents to trigger automatic paid transactions and transmit query data to a third party without sufficiently clear, upfront consent or awareness.
The example response contradicts the skill’s stated purpose of returning recent sold-price comps by providing active listings with asking prices instead. This can mislead downstream agents or users into treating unsold listing prices as market-clearing sale values, causing inaccurate valuation, pricing, or purchasing decisions.