mcp-cli-scripts
Pass
Audited by Gen Agent Trust Hub on Sep 4, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill recommends installing the
tsxpackage from the public npm registry to enable TypeScript execution in terminal environments.- [COMMAND_EXECUTION]: Includes templates that utilize the Node.jsfsmodule, specificallyfs.writeFileSync, to perform local file system write operations when saving script output to a user-specified path.- [INDIRECT_PROMPT_INJECTION]: Thescript-template.tsprovides a structure for processing external data through a command-line input flag, which creates a potential ingestion surface. - Ingestion points: The
parseArgsfunction intemplates/script-template.tsdefines an--inputargument to read content from local files. - Boundary markers: The provided template does not include explicit boundary markers or instructions to delimit ingested data.
- Capability inventory: The template includes file system write capabilities (
fs.writeFileSync) and standard output (console.log) functions. - Sanitization: No input sanitization, filtering, or validation logic for the content of processed files is included in the boilerplate code.- [DYNAMIC_EXECUTION]: Provides boilerplate code and templates intended to generate executable TypeScript scripts that are run directly via the
tsxruntime using a shebang pattern.
Audit Metadata