mcp-integration
Pass
Audited by Gen Agent Trust Hub on Sep 18, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADSDYNAMIC_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill enables a workflow where the agent ingests data from external sources (SSE, HTTP, and WebSocket servers) which may contain instructions targeting the LLM.
- Ingestion points: Data retrieved from external MCP server endpoints mentioned in SKILL.md and references/server-types.md.
- Boundary markers: Documentation recommends validation but the included configuration examples (examples/http-server.json) do not implement explicit delimiters for tool output interpolation.
- Capability inventory: The skill enables subprocess spawning through stdio servers (SKILL.md) and network egress through multiple server types.
- Sanitization: Instructions in references/tool-usage.md suggest validating parameters but provide no automated sanitization logic for content ingested from remote services.
- [COMMAND_EXECUTION]: The skill documents the configuration of stdio MCP servers, which involve executing local commands and arguments (e.g., using npx or python) as seen in examples/stdio-server.json.
- [EXTERNAL_DOWNLOADS]: The documentation references the use of npx to fetch and execute packages like @modelcontextprotocol/server-filesystem from the NPM registry, which is a well-known service.
- [DYNAMIC_EXECUTION]: The authentication guide (references/authentication.md) describes the use of headersHelper scripts that are executed at runtime to generate dynamic authentication headers, representing a form of dynamic code loading.
Audit Metadata