mcp-discovery
Pass
Audited by Gen Agent Trust Hub on Aug 26, 2026
Risk Level: SAFEREMOTE_CODE_EXECUTIONPROMPT_INJECTION
Full Analysis
- [REMOTE_CODE_EXECUTION]: The skill's core workflow involves discovering and executing external code via third-party MCP servers.
- It directs the agent to call
start_registry_mcp_serverto install and run packages from a public registry based on their descriptions. - While the skill mentions the exclusion of packages requiring environment variables, it fundamentally promotes the execution of unverified third-party code as a primary task-solving strategy.
- [INDIRECT_PROMPT_INJECTION]: The skill establishes a "Registry-first bias," instructing the agent to compare user tasks against external registry descriptions and prioritize those results over built-in tools.
- Ingestion points: Server names and descriptions returned by the
registry_synctool (SKILL.md). - Boundary markers: None; the agent is told to "Match from context with a Registry-first bias."
- Capability inventory: Execution of shell commands via
start_registry_mcp_serverand subsequent tool usage (SKILL.md). - Sanitization: None described for the incoming metadata from the registry.
- This creates an attack surface where a malicious registry entry with a craftily worded description could trick the agent into running a specific server, potentially bypassing safer local alternatives.
Audit Metadata