mcp-deepwiki
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted external data retrieved from public GitHub repositories, creating a surface for potential indirect prompt injection attacks.
- Ingestion points: Data enters the context via the
read_wiki_contentsandask_questionfunctionalities which retrieve repository data (SKILL.md). - Boundary markers: Absent. The instructions do not specify delimiters or guidelines to prevent the agent from executing instructions embedded within the fetched repository content.
- Capability inventory: The skill invokes CLI tools via
npx -y mcporterto interact with the MCP server (SKILL.md). - Sanitization: No sanitization or escaping mechanisms are defined for the incoming repository contents or user-supplied questions before they are passed to the shell template.
- [COMMAND_EXECUTION]: The skill provides command templates using
npx -y mcporterto invoke the MCP server operations directly from the shell (SKILL.md). If the agent interpolates unvalidated user input directly into these command strings, it could lead to argument injection or command parsing vulnerabilities.
Audit Metadata