directory-federation
Pass
Audited by Gen Agent Trust Hub on Jun 29, 2026
Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The code example demonstrates a tool that returns a shell command string (
docker run -i --rm mcp/wikipedia-mcp) intended for direct execution by the client agent. - [PROMPT_INJECTION]: The skill architecture facilitates indirect prompt injection by design, where tool metadata from one source dictates subsequent execution logic.
- Ingestion points: The return value of the
search_available_tools_and_serverstool inSKILL.md. - Boundary markers: No specific delimiters or instructions are provided to the agent to treat the metadata as untrusted.
- Capability inventory: The pattern assumes the agent has permissions to execute shell commands and establish network connections based on external data.
- Sanitization: The example lacks validation or escaping for the returned command strings or server connection parameters.
Audit Metadata