testing-mcp-tools-locally
Pass
Audited by Gen Agent Trust Hub on Sep 6, 2026
Risk Level: SAFECOMMAND_EXECUTIONDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTIONPRIVILEGE_ESCALATION
Full Analysis
- [COMMAND_EXECUTION]: The skill uses the vendor-specific CLI tool
hoglito perform environment management tasks such as starting Docker services (hogli start -d), waiting for health checks (hogli wait), and running database migrations (hogli migrations:run). - [DYNAMIC_EXECUTION]: Python scripts are executed via the
hogli dev:shell-pluscommand to interact directly with the application's database models. This is used to seedBatchImportrecords and generate API tokens for testing. - [INDIRECT_PROMPT_INJECTION]: The skill creates various test records with complex JSON configurations (e.g., S3 bucket prefixes, data formats). These records serve as the input for the migration tools being tested, providing a surface for evaluating how the system handles different data states.
- [PRIVILEGE_ESCALATION]: To enable staff-only tools for local testing, the skill includes instructions to programmatically set the
is_staffattribute toTruefor a local user account within the development database.
Audit Metadata