laravel-plugin-discovery
Pass
Audited by Gen Agent Trust Hub on Jul 29, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill requires the agent to connect to an external MCP server at https://laraplugins.io/mcp/plugins to function.
- [PROMPT_INJECTION]: The skill ingests untrusted content from an external third-party source, creating a surface for indirect prompt injection. 1. Ingestion points: Package descriptions and readme content are retrieved via the SearchPluginTool and GetPluginDetailsTool tools in SKILL.md. 2. Boundary markers: Absent; there are no delimiters or instructions to the agent to isolate external content from its internal logic. 3. Capability inventory: The agent is instructed to evaluate and recommend software packages based on the external data retrieved. 4. Sanitization: Absent; the skill does not perform any validation or filtering of the content returned by the external service.
Audit Metadata