pencil-mcp-replace-all-matching-properties

Pass

Audited by Gen Agent Trust Hub on Jun 13, 2026

Risk Level: SAFEPROMPT_INJECTION
Full Analysis
  • [PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it ingests and processes untrusted data (property values and node IDs) without using boundary markers or sanitization logic.
  • Ingestion points: The properties parameter (containing match and replace values) and the parents array in SKILL.md serve as entry points for data that may contain malicious instructions.
  • Boundary markers: There are no explicit delimiters or instructions provided to the agent to treat the processed property values as data rather than instructions.
  • Capability inventory: The skill utilizes the replace_all_matching_properties tool to modify document states based on the provided input.
  • Sanitization: No escaping, validation, or filtering of the external content is implemented in the skill instructions.
Audit Metadata
Risk Level
SAFE
Analyzed
Jun 13, 2026, 04:13 AM
Security Audit — agent-trust-hub — pencil-mcp-replace-all-matching-properties