suede-mcp-qa
Pass
Audited by Gen Agent Trust Hub on Oct 13, 2026
Risk Level: SAFECOMMAND_EXECUTIONDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill instructs the agent to execute local shell scripts and binaries, specifically
scripts/mcp-surface-snapshot.shandnode, to interact with a live Model Context Protocol (MCP) server for testing purposes. - [DYNAMIC_EXECUTION]: The script
scripts/mcp-surface-snapshot.shuses a shell heredoc to dynamically execute an embedded Node.js code block. This script processes JSON-RPC responses from the server and compares them against the localmcp/catalog.jsonfile. - [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and report output from an external process (the MCP server). This creates a vulnerability surface where a compromised or malicious server could return instructions disguised as tool descriptions, errors, or prompt content.
- Ingestion points: Standard output and error streams from the MCP server, and the parsed results from
scripts/mcp-surface-snapshot.sh. - Boundary markers: No specific delimiters or "ignore instructions" wrappers are used when the agent processes server-provided content.
- Capability inventory: The agent is authorized to execute shell commands, read/write local files, and manage Node.js processes.
- Sanitization: The skill lacks explicit sanitization or validation of the server's JSON-RPC responses before they are included in the agent's context for verification.
Audit Metadata