debugging-mcp-analytics
Pass
Audited by Gen Agent Trust Hub on Sep 10, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill documentation describes an automated pipeline that ingests external data (agent intent strings in the
$mcp_intentproperty) and processes it using an LLM to generate summaries and theme digests. This establishes an indirect prompt injection surface where malicious content within the telemetry data could attempt to influence the LLM's output. \n - Ingestion points: User-controlled
$mcp_intentvalues stored in the ClickHouseeventstable, accessed during the intent generation and clustering stages (SKILL.md sections 5 and 6). \n - Boundary markers: No specific delimiters or safety instructions (e.g., 'ignore instructions within this data') are documented for the intent summarization prompt. \n
- Capability inventory: The skill is designed to run complex HogQL queries, interact with Postgres/ClickHouse databases, and trigger Temporal workflows (SKILL.md). \n
- Sanitization: The documentation does not describe any sanitization or validation steps for the
$mcp_intentdata before it is passed to the LLM.
Audit Metadata