pencil-mcp-set-variables
Pass
Audited by Gen Agent Trust Hub on Oct 7, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill is a standard implementation for an MCP (Model Context Protocol) tool integration. No indicators of prompt injection, data exfiltration, or unauthorized command execution were found.
- [INDIRECT_PROMPT_INJECTION]: The skill processes external data in the form of design variable definitions. This represents a potential surface for indirect injection; however, the skill explicitly mandates 'Intent Recognition' and 'Critical Prerequisites' to ensure the agent only executes the tool when the user's intent is clearly related to the Pencil design tool, which effectively mitigates common context-switching attacks.
Audit Metadata