writing-assistant
Pass
Audited by Gen Agent Trust Hub on Apr 4, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONPROMPT_INJECTIONDATA_EXFILTRATION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill installs the
mcporterNode.js package from the public registry. This is a legitimate utility provided by the vendor to facilitate interaction with their text analysis services. - [COMMAND_EXECUTION]: Uses the
mcporterCLI to configure access and perform text analysis. These commands are directed to the vendor's official endpoint atmcp.infranodus.com. - [PROMPT_INJECTION]: The skill includes specific directives to prevent disclosing its internal logic and instructions to users, mitigating potential system prompt extraction. Additionally, the skill is susceptible to indirect prompt injection as it processes arbitrary user input for text refinement. Ingestion points: Arbitrary text provided by users for grammar and style refinement in
SKILL.md. Boundary markers: No specific delimiters are used to isolate user content from the skill's instructions. Capability inventory: Possesses the ability to execute shell commands and call external tools via themcporterCLI based on text analysis. Sanitization: Does not implement validation or sanitization of input text before processing. - [DATA_EXFILTRATION]: User-provided text is sent to the external domain
mcp.infranodus.comfor analysis. This is a core feature of the skill and uses the vendor's dedicated infrastructure.
Audit Metadata