mcp-server
Pass
Audited by Gen Agent Trust Hub on Oct 8, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes a local Node.js script (AgentChat-OneWeb/index.js) using child_process.spawn. This is the primary method used to trigger the provider automation logic.\n- [INDIRECT_PROMPT_INJECTION]: The skill processes user-supplied text and forwards it to external AI providers. This presents an attack surface where malicious instructions embedded in the input data could potentially bypass agent constraints at the provider level.\n
- Ingestion points: User input received through the prompt parameter in the gemini_think, gemini_chat, and web_ask tools.\n
- Boundary markers: Absent; the skill does not wrap the input in delimiters or provide instructions to the downstream AI to ignore embedded commands.\n
- Capability inventory: The skill can execute local scripts and manipulate a local web browser instance via CDP, including accessing active provider sessions.\n
- Sanitization: Absent; the input text is passed to the underlying automation script without filtering or escaping.
Audit Metadata