install-mcp

Pass

Audited by Gen Agent Trust Hub on Mar 3, 2026

Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill parses and writes command sequences (e.g., npx commands) from local catalog files into the project-level configuration file (.opencode/opencode.jsonc). This defines the specific executable behavior for local MCP servers when they are later invoked by the agent.
  • [PERSISTENCE_MECHANISMS]: In Step 7, the skill instructs the user to manually modify their shell configuration file (~/.zshrc) to include a source command. While this is a user-facing instruction rather than a direct automated modification, it involves system-level persistence mechanisms.
  • [PROMPT_INJECTION]: The skill exhibits an indirect injection surface by processing external configuration data to define agent capabilities.
  • Ingestion points: Catalog markdown files located at ~/.config/opencode/mcp/<name>.md are read and parsed for YAML frontmatter.
  • Boundary markers: No explicit boundary markers or delimiters are used when interpreting the catalog data.
  • Capability inventory: The skill has the capability to modify .opencode/opencode.jsonc, which directly influences the tools and commands the agent can execute within the workspace.
  • Sanitization: The skill lacks validation or sanitization logic for the command, url, or env fields extracted from the catalog before writing them to the active configuration.
Audit Metadata
Risk Level
SAFE
Analyzed
Mar 3, 2026, 07:17 AM
Security Audit — agent-trust-hub — install-mcp