stata-replication
Warn
Audited by Gen Agent Trust Hub on Oct 9, 2026
Risk Level: MEDIUMEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill requires the installation of the stata-mcp tool from an external GitHub repository (github.com/SepineTam/stata-mcp) which is not a recognized trusted organization or well-known service.
- [REMOTE_CODE_EXECUTION]: The skill uses the uvx tool to download and execute code for the stata-mcp package at runtime.
- [DYNAMIC_EXECUTION]: The skill programmatically generates Stata scripts (.do files) and executes them using the stata-mcp server based on project context.
- [INDIRECT_PROMPT_INJECTION]: The skill ingests data from external sources such as research papers or R scripts to scaffold analysis code. 1. Ingestion points: paper-or-data-pointer and scripts/R/ files. 2. Boundary markers: None identified in the prompt logic. 3. Capability inventory: Bash, Write, and stata-mcp. 4. Sanitization: No sanitization logic for input data is documented before interpolation into generated scripts.
- [COMMAND_EXECUTION]: The skill utilizes the Bash tool for environment verification, version checking, and dependency management.
Audit Metadata