mcp-developer
Fail
Audited by Gen Agent Trust Hub on Oct 4, 2026
Risk Level: CRITICALINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill defines a framework for building tools and resources that ingest data from external sources, creating a potential surface for indirect prompt injection.
- Ingestion points: Data enters the agent's context through tool call arguments (e.g., the
locationparameter in theget_weathertool example inSKILL.md) and dynamic resource URI templates (e.g.,user://{user_id}/profileinreferences/resources.md). - Boundary markers: The instructions demonstrate the implementation of Zod (TypeScript) and Pydantic (Python) schemas to enforce structural validation and type constraints on incoming data, which helps mitigate accidental obedience to embedded instructions.
- Capability inventory: The skill provides examples for performing file system operations (e.g.,
fs.readFile), database queries, and external network requests (e.g.,fetch,httpx), which are capabilities that could be targeted by malicious inputs if not properly sanitized. - Sanitization: Although input validation is prioritized, the final sanitization of content returned from tools to the agent depends on the developer's specific handler implementation logic to ensure the agent does not treat retrieved content as instructions.
Recommendations
- CRITICAL: 1 file(s) identified as malware by FileRep - DO NOT USE
- Contains 2 malicious URL(s) - DO NOT USE
Audit Metadata