syncing-mcp-servers
Pass
Audited by Gen Agent Trust Hub on Oct 9, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The verification workflow (Step 5) instructs the agent to execute a shell command (
copilot --prompt "list available MCP tools" --allow-all-tools -p "run /mcp show and exit") to confirm the configuration sync was successful. - [INDIRECT_PROMPT_INJECTION]: The skill ingests and processes data from repository-level files that could be controlled by an external party, creating a surface for indirect prompt injection.
- Ingestion points: The skill reads repository-level configuration from
.vscode/mcp.jsonas described in Step 1. - Boundary markers: The instructions do not specify boundary markers or validation steps to isolate potentially malicious commands within the synced JSON files.
- Capability inventory: The skill performs file system reads and writes to sensitive paths (user-level CLI config) and executes shell commands for verification.
- Sanitization: While the skill performs format conversion and merging, it does not sanitize the contents (commands, arguments, or URLs) of the MCP servers being added to the user's global configuration, which could allow a malicious project to inject persistent tools.
Audit Metadata