setup-arcreel-skills
Pass
Audited by Gen Agent Trust Hub on Oct 27, 2026
Risk Level: SAFEPERSISTENCEINDIRECT_PROMPT_INJECTION
Full Analysis
- [SAFE]: The skill provides instructions for standard service configuration. It describes how to verify and store connection details and API keys in local configuration files such as
.arcreel/settings.jsonand host-specific settings. This behavior is consistent with the intended purpose of a setup utility for a developer service. - [PERSISTENCE]: The skill establishes persistent connectivity by instructing the agent to save the
mcp_urlandapi_keyto local files and the host environment. This allows the agent to maintain its connection to the remote service across different sessions without manual reconfiguration. - [INDIRECT_PROMPT_INJECTION]: The skill creates a data ingestion surface by reading from and writing to the
.arcreel/settings.jsonworkspace file. - Ingestion points: Reads connection parameters from
.arcreel/settings.jsonin the local workspace. - Boundary markers: None explicitly defined in the configuration format.
- Capability inventory: The skill uses file-writing capabilities to save settings and performs tool calls (
list_projects) based on the ingested configuration. - Sanitization: The skill uses specific format checks (e.g., endpoint must end in
/mcp, API key must start witharc-) which provides basic validation for the ingested data.
Audit Metadata