codedb-mcp-fast-code-intelligence
Fail
Audited by Gen Agent Trust Hub on Sep 16, 2026
Risk Level: HIGHEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill directs the user to clone a repository from an unverified GitHub account (
github.com/killop/codedb-mcp.git). While GitHub is a well-known service, the specific organization/user is not recognized as a trusted entity. - [REMOTE_CODE_EXECUTION]: The setup instructions involve building the cloned source code using
cargo buildand executing the resulting binary. Furthermore, it requires running various unverified Node.js scripts (e.g.,build-module-atlas.mjs,codex-observe.mjs,generate-deepwiki.mjs) which poses a risk of executing malicious code contained within the downloaded repository. - [INDIRECT_PROMPT_INJECTION]: The skill indexes local codebase content to provide context for the AI agent, creating a vulnerability to indirect prompt injections.
- Ingestion points: Any local file indexed by the server (including
.rs,.ts,.py,.cs,.cppfiles) serves as an input vector. - Boundary markers: The skill metadata and tool descriptions do not define boundary markers to encapsulate the retrieved code or instruct the agent to ignore instructions embedded in the code comments.
- Capability inventory: The skill possesses extensive read capabilities (
codedb_read,codedb_context,codedb_explore) that can pull malicious instructions from an indexed file into the agent's active prompt. - Sanitization: There is no evidence of sanitization or filtering of indexed content to remove potential injection patterns before presenting them to the model.
Recommendations
- AI detected serious security threats
Audit Metadata