install-mcp
Pass
Audited by Gen Agent Trust Hub on Mar 3, 2026
Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill parses and writes command sequences (e.g., npx commands) from local catalog files into the project-level configuration file (
.opencode/opencode.jsonc). This defines the specific executable behavior for local MCP servers when they are later invoked by the agent. - [PERSISTENCE_MECHANISMS]: In Step 7, the skill instructs the user to manually modify their shell configuration file (
~/.zshrc) to include asourcecommand. While this is a user-facing instruction rather than a direct automated modification, it involves system-level persistence mechanisms. - [PROMPT_INJECTION]: The skill exhibits an indirect injection surface by processing external configuration data to define agent capabilities.
- Ingestion points: Catalog markdown files located at
~/.config/opencode/mcp/<name>.mdare read and parsed for YAML frontmatter. - Boundary markers: No explicit boundary markers or delimiters are used when interpreting the catalog data.
- Capability inventory: The skill has the capability to modify
.opencode/opencode.jsonc, which directly influences the tools and commands the agent can execute within the workspace. - Sanitization: The skill lacks validation or sanitization logic for the
command,url, orenvfields extracted from the catalog before writing them to the active configuration.
Audit Metadata