meigen-ai-design-mcp
Pass
Audited by Gen Agent Trust Hub on Sep 16, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill downloads and executes the MCP server package from the NPM registry via the
npx meigencommand during installation and runtime operation. - [COMMAND_EXECUTION]: The initialization and setup processes involve shell commands (
npx meigen init,/meigen:setup) to configure local environments and IDE integrations for MCP support. - [INDIRECT_PROMPT_INJECTION]: The skill exposes a surface for indirect prompt injection by ingesting untrusted data from an external GitHub repository (
jau123/nanobanana-trending-prompts) and processing local user-provided image files for reference during generation tasks. While these ingestion points allow external content to reach the agent, the risk is inherent to the functionality of a prompt-library and image-generation tool.
Audit Metadata