setup-mcp-connector
Warn
Audited by Gen Agent Trust Hub on Sep 14, 2026
Risk Level: MEDIUMEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill instructs the user to install and execute external Node.js packages named
kordocandkorean-dart-mcpusing thenpx -ycommand, which skips installation prompts. - [REMOTE_CODE_EXECUTION]: The skill configures the environment to use remote HTTP-based MCP servers located at
https://mcp.gomdori.app/stats,https://archhub-mcp.fly.dev/mcp, andhttps://mcp.gomdori.app/law. These services process user data and return instructions or data to the agent. - [DYNAMIC_EXECUTION]: The setup process relies on dynamic execution via
npxto fetch and run the latest versions of data parsing and connectivity tools at runtime. - [COMMAND_EXECUTION]: The documentation provides instructions for users to run various shell commands, including
node --version,npm uninstall, and complexnpxsetup scripts to modify local configuration files. - [INDIRECT_PROMPT_INJECTION]: The skill establishes an attack surface by connecting the agent to multiple external data sources including Google Drive, Notion, and various Korean government APIs.
- Ingestion points: Google Drive files, Notion pages, and multiple public API responses (OpenDART, KOSIS, Law API).
- Boundary markers: The skill does not provide specific instructions for delimiting or sanitizing data retrieved from these sources.
- Capability inventory: The setup enables capabilities like
parse_document,quick_stats,building_profile, andsearch_lawin associated skills. - Sanitization: No explicit sanitization or validation logic is defined for the external data ingested.
Audit Metadata