exploring-mcp-sessions
Pass
Audited by Gen Agent Trust Hub on Sep 26, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill ingests and processes untrusted data from MCP session logs, such as tool names, user-provided intent strings, and error messages. These values are used to generate agent summaries via an LLM, creating a surface for indirect prompt injection.
- Ingestion points: Session data is retrieved via the analytics tools and SQL queries described in SKILL.md.
- Boundary markers: No explicit delimiters or instructions to ignore embedded commands are defined for the ingested data.
- Capability inventory: The skill utilizes the posthog:execute-sql tool for database interaction (SKILL.md).
- Sanitization: No sanitization or validation of the ingested intent strings is performed before processing.
Audit Metadata