add-linked-particles
Fail
Audited by Gen Agent Trust Hub on Sep 7, 2026
Risk Level: HIGHREMOTE_CODE_EXECUTIONDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [REMOTE_CODE_EXECUTION]: The skill retrieves file contents and dependency lists from the
threenixMCP server and automatically writes these files to the user's repository and installs the packages. This enables an external, unverified service to provide and execute code on the local system. - [DYNAMIC_EXECUTION]: Step 7 of the workflow instructs the agent to run a build or type-check on the code that was dynamically fetched and written in Step 4, executing code sourced from a remote endpoint.
- [INDIRECT_PROMPT_INJECTION]: The skill reads instructions and manifests from the target repository at the start of its workflow, creating an attack surface for malicious data to influence agent behavior. 1. Ingestion points: Target repository instructions and manifest files (SKILL.md, Step 1). 2. Boundary markers: None identified; the skill does not specify delimiters or instructions to ignore embedded prompts. 3. Capability inventory: File-write operations, package installation, and build/type-check execution (SKILL.md, Steps 4, 6, 7). 4. Sanitization: No sanitization of the repository content or the remotely fetched code is described.
- [COMMAND_EXECUTION]: The skill executes package management and build tools (Steps 6 and 7) using parameters and code provided by the external MCP server.
Recommendations
- AI detected serious security threats
Audit Metadata