moysklad-mcp-install
Pass
Audited by Gen Agent Trust Hub on Sep 11, 2026
Risk Level: SAFEREMOTE_CODE_EXECUTIONDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [REMOTE_CODE_EXECUTION]: The skill instructs the agent to clone a remote repository from GitHub (
https://github.com/ilyautov/moysklad-mcp-ru) and execute scripts (install.py,serve.py) directly on the user's host machine when operating in a local CLI environment like Claude Code. - [DYNAMIC_EXECUTION]: The server script (
serve.py) is designed to automatically create a Python virtual environment and install necessary dependencies upon its first execution, involving runtime package installation. - [INDIRECT_PROMPT_INJECTION]: The skill provides tools to ingest data from the Moysklad JSON API (products, stocks, orders). This external data is processed by the agent, creating a surface for indirect prompt injection if the account content is controlled by a malicious actor.
- Ingestion points: External business data enters the agent context via API tools such as
ms_get_productsandms_get_stockdefined inserve.py. - Boundary markers: The instructions do not specify the use of delimiters or specific tags to isolate API-returned data from the agent's core instructions.
- Capability inventory: The agent possesses capabilities to execute shell commands, manage local files, and perform network requests to the Moysklad API.
- Sanitization: The skill instructions do not outline specific validation or sanitization procedures for the data retrieved from the external API before it is presented to the LLM.
Audit Metadata