exploring-mcp-tool-quality
Pass
Audited by Gen Agent Trust Hub on Jun 22, 2026
Risk Level: SAFEPROMPT_INJECTION
Full Analysis
- [PROMPT_INJECTION]: The skill presents a surface for indirect prompt injection by instructing the agent to ingest and analyze data from external tool outputs.
- Ingestion points: The skill queries
$mcp_error_messageand$exception_messagefrom theeventstable (e.g., in the 'why is a tool failing' workflow). This data represents logs from other tools and systems that may contain attacker-controlled content. - Boundary markers: The skill does not provide instructions to wrap this potentially untrusted data in delimiters or provide 'ignore embedded instructions' warnings to the agent.
- Capability inventory: The skill utilizes the
posthog:execute-sqltool to perform reads on the shared events table. - Sanitization: No sanitization, escaping, or filtering of the content within error messages is performed before the agent processes the results.
Audit Metadata