managing-mcp-servers
Pass
Audited by Gen Agent Trust Hub on Oct 29, 2026
Risk Level: SAFEDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [DYNAMIC_EXECUTION]: The skill instructs the agent to create and modify configuration files (
mcp.json) that utilize the!commandsyntax. This syntax allows for shell command execution to resolve configuration values at runtime (e.g., fetching authentication tokens viagh auth token). This provides a mechanism for the agent to generate and persist executable strings that the host system runs, which could be abused if the agent incorporates untrusted input into these commands. - [INDIRECT_PROMPT_INJECTION]: The skill implements dynamic tool discovery through the
tool_searchfunction for MCP servers configured with "deferred" exposure. This mechanism allows the agent to ingest and act upon tool definitions and metadata provided by external, potentially untrusted MCP servers, creating a surface for indirect prompt injection via malicious tool outputs or definitions. - Ingestion points: Results from the
tool_searchcommand and metadata/outputs from external MCP servers. - Boundary markers: None explicitly provided in the skill instructions to delimit external content.
- Capability inventory: The agent has the capability to modify configuration files, execute shell commands, and call tools hosted on remote MCP servers.
- Sanitization: No specific sanitization or validation logic for the external tool metadata is described.
Audit Metadata