mcp-advanced-tool-patterns
Pass
Audited by Gen Agent Trust Hub on Mar 31, 2026
Risk Level: SAFEPROMPT_INJECTION
Full Analysis
- [PROMPT_INJECTION]: The skill documents a
ToolOrchestratorpattern that dynamically resolves tool arguments from previous step results using a$prefix. This design creates a surface for indirect prompt injection, as malicious data returned by one tool could be used to manipulate the parameters of a subsequent tool execution.\n - Ingestion points:
workflowlist inToolOrchestrator.execute_workflowinSKILL.md.\n - Boundary markers: Absent; the pattern does not include instructions to the agent or logic to ignore embedded instructions in tool outputs.\n
- Capability inventory: The skill provides patterns for calling arbitrary tools (
server.call_tool), managing state (ToolSession), and making external network requests (httpx).\n - Sanitization: No sanitization or validation of resolved arguments is implemented in the orchestration pattern code snippet.
Audit Metadata