laravel-mcp

Pass

Audited by Gen Agent Trust Hub on Sep 15, 2026

Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [INDIRECT_PROMPT_INJECTION]: The skill provides patterns for creating MCP tools, prompts, and resources that process external input, which introduces a surface for indirect prompt injection.\n
  • Ingestion points: The handle methods in CurrentWeatherTool (SKILL.md, AGENTS.md, rules/tool-create.md), DescribeWeatherPrompt (AGENTS.md, rules/prompt-create.md), and UserFileResource (AGENTS.md, rules/resource-create.md) ingest user-supplied arguments.\n
  • Boundary markers: The skill documentation recommends using Laravel's validation engine to verify input parameters.\n
  • Capability inventory: Implementations include file system access using file_get_contents and the Storage facade (AGENTS.md, rules/resource-create.md, rules/tool-responses.md).\n
  • Sanitization: The examples demonstrate input validation using $request->validate to constrain external data.\n- [EXTERNAL_DOWNLOADS]: The skill references official project documentation and source code repositories hosted by trusted organizations.\n
  • It links to documentation on laravel.com and modelcontextprotocol.io, as well as the laravel/mcp repository on GitHub (AGENTS.md, metadata.json).
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 15, 2026, 06:56 AM