mxs-cli-ai-author
Pass
Audited by Gen Agent Trust Hub on Jul 30, 2026
Risk Level: SAFEDATA_EXFILTRATIONPROMPT_INJECTION
Full Analysis
- [DATA_EXFILTRATION]: The skill's documentation specifies the default file system locations for sensitive configuration and authentication data, specifically
~/.config/mxs/credentials.json(containing access tokens and refresh tokens) and~/.config/mxs/config.json(documented in references/auth-config-output.md). These are vendor-specific paths managed by the mxs tool. - [PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection due to its core functionality of reading and writing content from an external CMS.
- Ingestion points: The agent is instructed to fetch potentially untrusted data from the server using commands like
mxs post get,mxs note get, andmxs comment list(found in references/command-index.md). - Boundary markers: The instructions do not define strict delimiters or boundary markers to distinguish content retrieved from the server from the agent's internal instruction sequence.
- Capability inventory: The agent has a broad set of capabilities, including the ability to delete content (
mxs post delete) and modify server-wide settings (mxs config set), which could be targeted by instructions embedded in the ingested data (found in references/command-index.md). - Sanitization: No specific requirements are provided for sanitizing or escaping the content read from the server before the agent processes it.
Audit Metadata