mcp-db-server-stateless
Fail
Audited by Gen Agent Trust Hub on Jun 22, 2026
Risk Level: HIGHEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONPROMPT_INJECTIONCREDENTIALS_UNSAFE
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill's installation instructions require cloning source code from an untrusted GitHub repository (https://github.com/PerfectXM/mcp-db-server.git) that is not affiliated with the author's known domains or trusted organizations.
- [REMOTE_CODE_EXECUTION]: The provided installation workflow involves running the downloaded code through the Maven wrapper, Docker, or a JAR file, which allows for arbitrary code execution on the local host.
- [PROMPT_INJECTION]: The skill processes untrusted database content and metadata, creating a vulnerability to indirect prompt injection. Ingestion points: Results from 'executeQuery', table names from 'listTables', and schema details from 'describeTable'. Boundary markers: None identified. Capability inventory: High-privilege write operations ('executeUpdate') and network connectivity to arbitrary hosts. Sanitization: No documented validation or sanitization of database content.
- [CREDENTIALS_UNSAFE]: The design of the tools requires the database password to be passed in plain text for every operation, potentially exposing sensitive credentials in the agent's conversation history and session logs.
Recommendations
- AI detected serious security threats
Audit Metadata