mcp2cli-api-to-cli
Warn
Audited by Gen Agent Trust Hub on Sep 16, 2026
Risk Level: MEDIUMCOMMAND_EXECUTIONREMOTE_CODE_EXECUTIONPERSISTENCEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill provides and documents the use of the
--mcp-stdioflag, which executes arbitrary shell commands provided by the user or agent to launch local MCP servers. - [REMOTE_CODE_EXECUTION]: The installation instructions direct the user to download and execute code from unverified remote sources using
npx,uv, anduvx. Specifically, it references theknowsuchagency/mcp2clirepository and themcp2clipackage, neither of which are from a recognized trusted vendor. - [PERSISTENCE]: The
bake installcommand is designed to write executable wrapper scripts into the user's~/.local/bin/directory. This capability can be used to achieve persistence or hijack commands if the tool is configured to run malicious code. - [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted external data from OpenAPI, GraphQL, and MCP endpoints to dynamically generate its command-line interface. This creates an attack surface where a malicious API specification could influence the agent's behavior.
- Ingestion points: Remote URLs supplied to the
--spec,--graphql, and--mcpflags inSKILL.md. - Boundary markers: None present to distinguish between tool definitions and potentially malicious instructions within the spec.
- Capability inventory: Includes shell command execution (
--mcp-stdio), arbitrary network requests, and filesystem write access (bake install). - Sanitization: The tool relies on dynamic interpretation of schemas without explicit sanitization or validation of the content against prompt injection patterns.
- [EXTERNAL_DOWNLOADS]: The skill fetches remote resources such as OpenAPI, GraphQL, or MCP specifications during runtime to configure its operations and generate commands.
Audit Metadata