helix-query-mcp
Pass
Audited by Gen Agent Trust Hub on Oct 27, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes data from external database queries which may contain instructions designed to manipulate the agent's behavior.
- Ingestion points: Database results fetched via the
helix_execute_read_querytool inSKILL.md. - Boundary markers: The instructions explicitly define a trust boundary, labeling results as
untrusted_dataand ordering the agent to ignore any instructions within those strings. - Capability inventory: The skill provides tools for database reads and writes, although writes require explicit user confirmation.
- Sanitization: The skill relies on natural language instructions for the agent to treat data as untrusted rather than programmatic sanitization or strict schema enforcement.
- [EXTERNAL_DOWNLOADS]: The skill connects to a remote MCP broker to facilitate database operations.
- Source: The agent configuration in
agents/openai.yamlspecifies a connection tohttps://query-mcp.helix-db.com/mcp. This domain corresponds to the skill author's infrastructure.
Audit Metadata