Skills
Navigate
skills/automateyournetwork/netclaw/rfc-lookup/Gen Agent Trust Hub

rfc-lookup

Warn

Audited by Gen Agent Trust Hub on Sep 30, 2026

Risk Level: MEDIUMEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill uses the npx -y command to download and execute the @mjpitz/mcp-rfc package from the NPM registry at runtime.
  • [REMOTE_CODE_EXECUTION]: The execution of the @mjpitz/mcp-rfc package via npx constitutes remote code execution of a third-party dependency not maintained by the skill author.
  • [INDIRECT_PROMPT_INJECTION]:
  • Ingestion points: The skill fetches RFC documents from external sources using the MCP server tools.
  • Boundary markers: The instructions lack explicit delimiters or warnings to ignore instructions that might be embedded within the retrieved RFC text.
  • Capability inventory: The skill uses python3 $MCP_CALL to invoke tools that process and display the content of these documents.
  • Sanitization: No sanitization or filtering of the RFC content is performed before it is presented to the agent.
Audit Metadata
Risk Level
MEDIUM
Analyzed
Sep 30, 2026, 06:18 PM