capacitor-mcp

Pass

Audited by Gen Agent Trust Hub on Jul 12, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONREMOTE_CODE_EXECUTIONPROMPT_INJECTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill facilitates downloading the awesome-ionic-mcp server from the NPM registry and fetching documentation from various external sources.
  • Evidence: The setup instructions utilize npx to download and run the MCP server.
  • Evidence: Documentation is retrieved from external domains such as ionicframework.com, capacitorjs.com, and capgo.app.
  • [COMMAND_EXECUTION]: Provides tools for an AI agent to execute local CLI commands for project management, builds, and platform synchronization.
  • Evidence: Tools like ionic_build, capacitor_sync, capacitor_run, and ionic_generate act as wrappers for system shell commands.
  • Evidence: The ionic_config_set tool allows modification of project-level configuration.
  • [REMOTE_CODE_EXECUTION]: Utilizes the npx utility to execute remote packages at runtime.
  • Evidence: Configuration examples for Claude Desktop, Cline, and Cursor show execution of awesome-ionic-mcp via the npx command.
  • [PROMPT_INJECTION]: The skill exhibits an attack surface for indirect prompt injection because it ingests data from external websites and passes it to an agent with significant system capabilities.
  • Ingestion points: Data is ingested via get_component_api, get_official_plugin_api, and get_plugin_api from external web documentation.
  • Boundary markers: No specific delimiters or instructions to ignore embedded commands are defined.
  • Capability inventory: The skill exposes high-impact CLI commands including ionic_start, ionic_build, capacitor_run, and capacitor_add.
  • Sanitization: There is no documented mechanism for sanitizing or escaping the content retrieved from external sources before it is processed by the agent.
Audit Metadata
Risk Level
SAFE
Analyzed
Jul 12, 2026, 07:38 AM