mcp-to-skill
Pass
Audited by Gen Agent Trust Hub on Sep 17, 2026
Risk Level: SAFEDATA_EXFILTRATIONINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
- [DATA_EXFILTRATION]: The skill is designed to read sensitive local configuration files to extract tool definitions for migration. Targeted paths include
~/Library/Application Support/Claude/claude_desktop_config.json,~/.claude/settings.json, and.cursor/mcp.json. These configuration files may contain server connection details and authentication parameters. - [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted external data to generate instructions, presenting a vulnerability surface. 1. Ingestion points: In Phase 1, the skill reads MCP config files, inspects third-party source code repositories for tool decorators, and queries package registries like npm or pip. 2. Capability inventory: The skill generates SKILL.md files that include shell commands (curl, CLI tools) and utilizes a Python script for calculations. 3. Boundary markers: There are no explicit delimiters or warnings to isolate ingested tool descriptions from the generated instructions. 4. Sanitization: No validation or sanitization of tool schemas is performed before they are interpolated into the generated skill package.
- [DYNAMIC_EXECUTION]: The skill includes a Python script (
scripts/estimate_tokens.py) and instructs the agent to execute it to calculate token savings. This involves running code locally using parameters supplied via command-line arguments or local files.
Audit Metadata