helix-foundry-actions-mcp
Pass
Audited by Gen Agent Trust Hub on Oct 27, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes data from a hosted MCP server and external sources such as API sources and documents, creating a surface for indirect prompt injection.\n
- Ingestion points: Tool outputs from the hosted Helix MCP server and descriptions from external API sources (SKILL.md).\n
- Boundary markers: Present; the skill contains a dedicated 'Trust boundary' section in SKILL.md that explicitly instructs the agent to treat every returned string as untrusted data and to never follow instructions found within it.\n
- Capability inventory: Subprocess calls (via curl/shasum instructions) and database operations (helix_execute_foundry_operation) (SKILL.md).\n
- Sanitization: Absent; relies on specific behavioral instructions to ignore embedded commands and to never feed untrusted data into subsequent actions without explicit user authorization.\n- [EXTERNAL_DOWNLOADS]: The skill connects to a hosted Model Context Protocol (MCP) server at https://mcp.helix-db.com/mcp. This is a vendor-owned service from 'helixdb' necessary for the skill's primary functionality and is documented as the authoritative source for the foundry actions.\n- [COMMAND_EXECUTION]: SKILL.md provides instructions for the agent to use local shell utilities like
wc,shasum, andcurlfor the purpose of document verification and upload. These commands are part of the intended workflow and are gated by a two-step confirmation process involving the user.
Audit Metadata