improving-mcp-tools
Pass
Audited by Gen Agent Trust Hub on Sep 6, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process raw production data, creating a surface for indirect prompt injection attacks. An attacker could craft specific inputs that, when reviewed by the agent as 'failed intents,' might trick the agent into suggesting malicious modifications to tool descriptions or schemas.
- Ingestion points: The skill retrieves untrusted data from production logs via tools like
query-mcp-tool-sample-intentsandquery-mcp-tool-failures(mentioned inSKILL.md). - Boundary markers: There are no explicit instructions to use delimiters or ignore embedded directives when processing these intents.
- Capability inventory: The agent has the capability to write to a specific allowlist of files (including
tools.yamland skill files) and to create pull requests (detailed in the 'One iteration' section ofSKILL.md). - Sanitization: The skill does not define specific sanitization or filtering logic for the raw user intents before they are analyzed by the LLM.
- Mitigation factors: The risk is significantly reduced by the mandatory 'draft PR for human review' default and the strict allowlist that prevents the agent from modifying critical system code, handler logic, or authentication paths.
Audit Metadata