laravel-plugin-discovery
Pass
Audited by Gen Agent Trust Hub on Jul 4, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill requires connection to an external MCP server located at
https://laraplugins.io/mcp/plugins. This is used to query the LaraPlugins database for package information and is the primary functional component of the skill. - [PROMPT_INJECTION]: The skill incorporates an indirect prompt injection surface by ingesting external data, such as package descriptions and README content, from the LaraPlugins API.
- Ingestion points: Package metadata and README content are fetched in
SearchPluginToolandGetPluginDetailsTool(SKILL.md). - Boundary markers: None identified in the prompt instructions to delimit external content.
- Capability inventory: The skill uses MCP tools to fetch data; while no direct system execution is defined in this file, the agent typically possesses file-system or shell capabilities.
- Sanitization: No explicit sanitization or filtering of the remote content is mentioned.
Audit Metadata