Skills
skills/aradotso/mcp-skills/mcp-servers-for-revit-integration/Gen Agent Trust Hub

mcp-servers-for-revit-integration

Fail

Audited by Gen Agent Trust Hub on Jun 15, 2026

Risk Level: HIGHREMOTE_CODE_EXECUTIONDATA_EXFILTRATIONEXTERNAL_DOWNLOADS
Full Analysis
  • [REMOTE_CODE_EXECUTION]: The tool send_code_to_revit accepts raw C# code as an argument and executes it directly within the Revit application context. This provides a direct vector for arbitrary code execution if the agent is targeted with prompt injection.
  • [DATA_EXFILTRATION]: The export_room_data tool allows the agent to write data to any user-specified local file path via the outputPath argument. A lack of path restrictions could lead to unauthorized file creation or the overwriting of sensitive system files.
  • [REMOTE_CODE_EXECUTION]: The query_stored_data tool executes raw SQL strings against a local database, which serves as a surface for SQL injection and unauthorized access to stored project data.
  • [EXTERNAL_DOWNLOADS]: The skill facilitates the download of binary plugins from GitHub and the execution of a server package from npm via npx, both of which involve running code from external sources during the installation process.
Recommendations
  • AI detected serious security threats
Audit Metadata
Risk Level
HIGH
Analyzed
Jun 15, 2026, 01:04 AM
Security Audit — agent-trust-hub — mcp-servers-for-revit-integration