Skills
Navigate
skills/reason-machines/mcp-skills/mcp-cli-tool/Gen Agent Trust Hub

mcp-cli-tool

Fail

Audited by Gen Agent Trust Hub on Sep 16, 2026

Risk Level: CRITICALREMOTE_CODE_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
  • [REMOTE_CODE_EXECUTION]: Installation instructions recommend executing a remote shell script via curl -fsSL https://raw.githubusercontent.com/philschmid/mcp-cli/main/install.sh | bash. This pattern allows for the execution of unverified and potentially malicious code from a non-trusted repository.
  • [EXTERNAL_DOWNLOADS]: Manual installation requires downloading and installing a package directly from a third-party GitHub repository (https://github.com/philschmid/mcp-cli) using bun install -g. This bypasses standard package registry safety checks.
  • [INDIRECT_PROMPT_INJECTION]: The skill facilitates agent interaction with MCP servers which ingest and process external data, creating an injection surface.
  • Ingestion points: Tool arguments provided to mcp-cli call and responses retrieved from the servers as shown in SKILL.md.
  • Boundary markers: The skill documentation and provided system prompt template lack clear delimiters or instructions to treat tool outputs as untrusted data.
  • Capability inventory: The tool allows for reading files and interacting with the GitHub API, providing significant privilege if the agent is misled by malicious data.
  • Sanitization: There are no documented sanitization or escaping steps for data passed to or from the mcp-cli tool.
Recommendations
  • HIGH: Downloads and executes remote code from: https://raw.githubusercontent.com/philschmid/mcp-cli/main/install.sh - DO NOT USE without thorough review
  • AI detected serious security threats
Audit Metadata
Risk Level
CRITICAL
Analyzed
Sep 16, 2026, 10:43 PM
Security Audit — agent-trust-hub — mcp-cli-tool