monte-carlo-remediation

Pass

Audited by Gen Agent Trust Hub on May 13, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSDATA_EXFILTRATIONPROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill provides instructions for the agent to use local CLI tools like gh, git, dbt, and airflow, as well as curl to interact with external APIs for remediation purposes.
  • Evidence: Found in SKILL.md (Workflow 2 and 3) and references/tool-discovery.md.
  • Mitigations: Detailed safety rails in references/safety.md mandate explaining planned actions and obtaining explicit user confirmation before executing any command that triggers a pipeline or modifies data.
  • [EXTERNAL_DOWNLOADS]: The setup instructions involve fetching configuration for an MCP server and installing the skill from the vendor's repository.
  • Evidence: README.md documents adding an MCP server from https://integrations.getmontecarlo.com/mcp and installing the toolkit via npx skills add monte-carlo-data/mc-agent-toolkit.
  • Context: These resources are hosted on domains and repositories associated with the skill's author, monte-carlo-data.
  • [DATA_EXFILTRATION]: The skill reads alert metadata, table schemas, and warehouse query logs, and can send this information to external services like dbt Cloud or Airflow to facilitate automated fixes.
  • Evidence: SKILL.md describes workflows for gathering alert and pipeline context, which is then used to construct API calls via curl as described in references/tool-discovery.md.
  • [PROMPT_INJECTION]: The skill possesses an indirect prompt injection surface as it processes data from external sources like automated troubleshooting results and SQL query logs.
  • Ingestion points: SKILL.md (Workflow 1) uses tools like get_alerts, run_troubleshooting_agent, and get_queries_for_table to ingest external data.
  • Boundary markers: Explicit delimiters or instructions to ignore instructions within the ingested data are not present.
  • Capability inventory: The skill can execute shell commands (curl, git, gh, airflow, dbt) and modify incident status or documentation.
  • Sanitization: No explicit data sanitization or filtering is specified for the content fetched from the Monte Carlo platform or warehouse logs.
Audit Metadata
Risk Level
SAFE
Analyzed
May 13, 2026, 04:31 PM
Security Audit — agent-trust-hub — monte-carlo-remediation