laravel-mcp
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill provides patterns for creating MCP tools, prompts, and resources that process external input, which introduces a surface for indirect prompt injection.\n
- Ingestion points: The
handlemethods inCurrentWeatherTool(SKILL.md, AGENTS.md, rules/tool-create.md),DescribeWeatherPrompt(AGENTS.md, rules/prompt-create.md), andUserFileResource(AGENTS.md, rules/resource-create.md) ingest user-supplied arguments.\n - Boundary markers: The skill documentation recommends using Laravel's validation engine to verify input parameters.\n
- Capability inventory: Implementations include file system access using
file_get_contentsand theStoragefacade (AGENTS.md, rules/resource-create.md, rules/tool-responses.md).\n - Sanitization: The examples demonstrate input validation using
$request->validateto constrain external data.\n- [EXTERNAL_DOWNLOADS]: The skill references official project documentation and source code repositories hosted by trusted organizations.\n - It links to documentation on
laravel.comandmodelcontextprotocol.io, as well as thelaravel/mcprepository on GitHub (AGENTS.md, metadata.json).
Audit Metadata