sdl-mcp-symbol-delta-ledger
Warn
Audited by Gen Agent Trust Hub on Jul 11, 2026
Risk Level: MEDIUMCOMMAND_EXECUTIONEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The
sdl.runtime.executetool permits the agent to invoke system executables such asnpm,node, andpython3. While intended for test execution, this provides a mechanism for the agent to run arbitrary scripts or commands within the local environment if manipulated. - [EXTERNAL_DOWNLOADS]: The skill's setup instructions require users to download and install the
sdl-mcppackage and its dependencies from the public NPM registry. - [REMOTE_CODE_EXECUTION]: The documentation encourages the use of
npx --yes sdl-mcp@latest, which facilitates the direct download and execution of code from a remote registry. - [PROMPT_INJECTION]: The skill represents an indirect prompt injection surface as it is designed to ingest and process arbitrary codebase content that could contain hidden instructions designed to manipulate the agent's behavior during analysis.
- Ingestion points: Codebase indexing and symbol retrieval via
sdl.symbol.*andsdl.iris.*tools. - Boundary markers: No explicit boundary markers or instruction-isolation logic is defined in the skill documentation.
- Capability inventory: The skill provides access to raw source code (
sdl.iris.rawSource) and the ability to execute commands (sdl.runtime.execute). - Sanitization: There are no mentions of sanitization or safety filters applied to the content retrieved from the codebase.
Audit Metadata