capacitor-mcp

Warn

Audited by Gen Agent Trust Hub on Oct 18, 2026

Risk Level: MEDIUMEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONPRIVILEGE_ESCALATIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [REMOTE_CODE_EXECUTION]: The skill instructs the agent to run npx -y awesome-ionic-mcp@latest and npx @capgo/cli@latest mcp, which downloads and executes code from the npm registry at runtime.
  • [EXTERNAL_DOWNLOADS]: The setup process involves downloading the awesome-ionic-mcp community package and the @capgo/cli tool.
  • [COMMAND_EXECUTION]: The skill uses shell commands for registering servers (e.g., claude mcp add), using Xcode utilities (xcrun mcpbridge), and configuring developer tools (xcode-select).
  • [PRIVILEGE_ESCALATION]: The skill advises using sudo xcode-select -s to modify the system's active developer directory, a task that requires administrative access.
  • [INDIRECT_PROMPT_INJECTION]: The skill processes external information that could contain hidden instructions.
  • Ingestion points: The awesome-ionic-mcp server fetches documentation and plugin data from the web and GitHub repositories.
  • Boundary markers: The skill does not define specific delimiters for external content, but suggests performing verification using read-only tools first.
  • Capability inventory: The servers provide tools for building apps, syncing project files, and performing account actions like deleting apps.
  • Sanitization: The documentation notes that the awesome-ionic-mcp server filters shell metacharacters from arguments to prevent command injection attacks.
Audit Metadata
Risk Level
MEDIUM
Analyzed
Oct 18, 2026, 03:42 PM