bing-image-search-mcp
Pass
Audited by Gen Agent Trust Hub on Mar 10, 2026
Risk Level: SAFECREDENTIALS_UNSAFEEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
- [CREDENTIALS_UNSAFE]: The scripts 'scripts/search_images.py' and 'scripts/search_images_batch.py' contain a hardcoded demo access key ('BETA_TEST_KEY_MARCH_2026'). While intended for testing, hardcoding credentials is a suboptimal practice.
- [EXTERNAL_DOWNLOADS]: The skill connects to the vendor's API endpoint at 'deepnlp.org' via the 'ai_agent_marketplace' library.
- [PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection.
- Ingestion points: The 'query' and 'query_list' parameters in 'scripts/search_images.py' and 'scripts/search_images_batch.py' ingest user-controlled data.
- Boundary markers: No explicit delimiters or instructions to ignore embedded commands are present in the scripts or metadata.
- Capability inventory: The skill communicates with an external API service (deepnlp.org) and returns the retrieved data to the user.
- Sanitization: No input validation, escaping, or filtering is applied to the tool arguments before processing.
Audit Metadata