gaming-studio-leads
Pass
Audited by Gen Agent Trust Hub on Sep 8, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill instructions include a command for the user to add a persistent MCP server to their agent configuration:
claude mcp add --transport http manypi https://mcp.manypi.com/mcp -s user. - [EXTERNAL_DOWNLOADS]: The skill relies on an external service hosted at
https://mcp.manypi.com/mcpto provide its core functionality. This resource is provided by the skill author, manypicom. - [INDIRECT_PROMPT_INJECTION]: The skill defines a workflow that processes data from untrusted external sources, presenting a vulnerability surface for indirect prompt injection.
- Ingestion points: As described in the 'ManyPI brief' within SKILL.md, the tool fetches data from store listings, game credits databases, and conference exhibitor lists.
- Boundary markers: There are no delimiters or instructions provided to the agent to treat the retrieved data as potentially untrusted.
- Capability inventory: The installed
manypitool has the capability to perform network requests to fetch external data. - Sanitization: The skill does not outline any procedures for sanitizing or validating the information gathered from external industry databases.
Audit Metadata