laravel-plugin-discovery
Pass
Audited by Gen Agent Trust Hub on Apr 6, 2026
Risk Level: SAFEDATA_EXFILTRATIONPROMPT_INJECTION
Full Analysis
- [DATA_EXFILTRATION]: The skill requires the agent to connect to
https://laraplugins.io/mcp/pluginsto perform searches and retrieve package metrics. This activity involves network operations to a third-party domain not on the predefined allowlist. - [PROMPT_INJECTION]: The skill processes untrusted external data such as package READMEs and descriptions, which constitutes an indirect prompt injection surface.
- Ingestion points: Data is retrieved from the LaraPlugins API via the
SearchPluginToolandGetPluginDetailsTool(as defined inSKILL.md). - Boundary markers: The skill lacks explicit instructions or delimiters to isolate untrusted external content or warn the agent against executing embedded instructions.
- Capability inventory: The skill itself does not provide tools for file system modifications or code execution, limiting the impact of potential injections.
- Sanitization: There are no documented sanitization or validation steps for the data received from the remote MCP server.
Audit Metadata