setup-mcp-connector

Warn

Audited by Gen Agent Trust Hub on Sep 14, 2026

Risk Level: MEDIUMEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill instructs the user to install and execute external Node.js packages named kordoc and korean-dart-mcp using the npx -y command, which skips installation prompts.
  • [REMOTE_CODE_EXECUTION]: The skill configures the environment to use remote HTTP-based MCP servers located at https://mcp.gomdori.app/stats, https://archhub-mcp.fly.dev/mcp, and https://mcp.gomdori.app/law. These services process user data and return instructions or data to the agent.
  • [DYNAMIC_EXECUTION]: The setup process relies on dynamic execution via npx to fetch and run the latest versions of data parsing and connectivity tools at runtime.
  • [COMMAND_EXECUTION]: The documentation provides instructions for users to run various shell commands, including node --version, npm uninstall, and complex npx setup scripts to modify local configuration files.
  • [INDIRECT_PROMPT_INJECTION]: The skill establishes an attack surface by connecting the agent to multiple external data sources including Google Drive, Notion, and various Korean government APIs.
  • Ingestion points: Google Drive files, Notion pages, and multiple public API responses (OpenDART, KOSIS, Law API).
  • Boundary markers: The skill does not provide specific instructions for delimiting or sanitizing data retrieved from these sources.
  • Capability inventory: The setup enables capabilities like parse_document, quick_stats, building_profile, and search_law in associated skills.
  • Sanitization: No explicit sanitization or validation logic is defined for the external data ingested.
Audit Metadata
Risk Level
MEDIUM
Analyzed
Sep 14, 2026, 04:23 PM