mcp-circuit-breaker
Pass
Audited by Gen Agent Trust Hub on Aug 28, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTIONDATA_EXFILTRATION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to automatically trigger and ingest error messages from '3+ consecutive failed calls' in a session. This creates a vulnerability surface where an attacker-controlled external tool or website could return malicious error messages designed to influence the agent's behavior.
- Ingestion points: Automatic activation on 3+ consecutive MCP failures (SKILL.md, 'Triggers' and 'Done When' sections).
- Boundary markers: None specified for error message processing.
- Capability inventory: File reads via Bash, directory creation, file writing via Bash, and fallback tool execution.
- Sanitization: No sanitization is mentioned for the failure messages used to classify error types (Step 1).
- [COMMAND_EXECUTION]: The skill uses
Bashto check for and read local configuration files like.mcp.json,.claude/settings.json, and~/.claude.json(Step 1). While primarily used for diagnosis, these tools could be used to execute arbitrary commands if input is manipulated. - [DATA_EXFILTRATION]: The skill specifically targets sensitive local files containing MCP server configurations and potentially credentials (
~/.claude.json,.claude/settings.local.json). While the skill logic only greps for server names, it establishes a pattern of accessing sensitive identity/config locations.
Audit Metadata