nlweb-mcp-server
Pass
Audited by Gen Agent Trust Hub on Sep 17, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill fetches documentation and protocol specifications from external URLs including github.com/nlweb-ai/NLWeb and modelcontextprotocol.io. These resources are used to verify API schemas and protocol standards.
- [INDIRECT_PROMPT_INJECTION]: The skill relies on live content from a remote GitHub repository and the official MCP specification site to determine tool schemas and protocol versions. This creates a surface where compromised remote content could influence agent behavior.
- Ingestion points: github.com/nlweb-ai/NLWeb (documentation and source code), modelcontextprotocol.io (specification).
- Boundary markers: Absent.
- Capability inventory: Read, Write, Edit, Bash, Grep, Glob, WebSearch, WebFetch.
- Sanitization: Absent.
Audit Metadata