aiwg-mcp-server
Warn
Audited by Gen Agent Trust Hub on Jun 19, 2026
Risk Level: MEDIUMCOMMAND_EXECUTIONEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill uses unvalidated placeholders such as
<client>,<mcp-server-ref>, and<name>within shell command templates (e.g.,aiwg mcp install <client>,aiwg mcp add <mcp-server-ref>). This creates a vulnerability to command injection where malicious input containing shell metacharacters (e.g.,;,&&,|) could execute arbitrary commands on the host system. - Ingestion points: Placeholders in the 'Behavior' and 'Examples' sections of SKILL.md receive user-provided strings.
- Boundary markers: No delimiters or escaping mechanisms are used to separate user input from the command string.
- Capability inventory: The skill is designed to run several shell-based subcommands using the
aiwgCLI. - Sanitization: There is no evidence of validation or sanitization for the inputs before they are passed to the shell.
- [EXTERNAL_DOWNLOADS]: The
aiwg mcp add <mcp-server-ref>command allows the agent to register external MCP servers from remote references, such as NPM packages or third-party repositories. This introduces code from external sources into the local environment. - [REMOTE_CODE_EXECUTION]: By design, registered MCP servers are intended to be executed by the host platform. The ability to add arbitrary external references creates a mechanism for remote code execution if the sources are untrusted or compromised.
Audit Metadata