mcp-server-bash-sdk
Warn
Audited by Gen Agent Trust Hub on Jun 15, 2026
Risk Level: MEDIUMEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONPROMPT_INJECTIONDATA_EXFILTRATION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill instructs users to clone a repository from an unverified GitHub account (github.com/muthuishere/mcp-server-bash-sdk) which is not associated with the skill author or a recognized trusted vendor. This introduces a supply chain risk.
- [COMMAND_EXECUTION]: Code examples for 'System Command Wrappers' use user-supplied input directly in shell commands (e.g.,
ps aux | grep -i "$filter"), creating a significant risk of command injection if the input contains shell-active characters. - [DATA_EXFILTRATION]: The provided 'File Operations' templates allow the agent to read and write files using user-provided paths. The implementation
fullpath="${WORKSPACE_DIR}/${filepath}"lacks directory traversal protection (e.g., checking for../), which could lead to unauthorized access to sensitive system files. - [PROMPT_INJECTION]: The skill architecture is vulnerable to indirect prompt injection because it passes untrusted data from an AI agent to bash tools without adequate sanitization.
- Ingestion points: Tool functions such as
tool_get_weatherandtool_read_fileingest arguments directly via the$1parameter inSKILL.md. - Boundary markers: No delimiters or explicit 'ignore embedded instructions' warnings are present in the provided templates to isolate adversarial input.
- Capability inventory: The examples utilize powerful system utilities including
curl,cat,ps, and shell redirection to files. - Sanitization: The implementation uses
jq -rfor data extraction but omits necessary shell escaping and path validation before executing system calls.
Audit Metadata