gaming-studio-leads

Pass

Audited by Gen Agent Trust Hub on Sep 8, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill instructions include a command for the user to add a persistent MCP server to their agent configuration: claude mcp add --transport http manypi https://mcp.manypi.com/mcp -s user.
  • [EXTERNAL_DOWNLOADS]: The skill relies on an external service hosted at https://mcp.manypi.com/mcp to provide its core functionality. This resource is provided by the skill author, manypicom.
  • [INDIRECT_PROMPT_INJECTION]: The skill defines a workflow that processes data from untrusted external sources, presenting a vulnerability surface for indirect prompt injection.
  • Ingestion points: As described in the 'ManyPI brief' within SKILL.md, the tool fetches data from store listings, game credits databases, and conference exhibitor lists.
  • Boundary markers: There are no delimiters or instructions provided to the agent to treat the retrieved data as potentially untrusted.
  • Capability inventory: The installed manypi tool has the capability to perform network requests to fetch external data.
  • Sanitization: The skill does not outline any procedures for sanitizing or validating the information gathered from external industry databases.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 8, 2026, 03:46 AM