pal-mcp-server-multi-model-orchestration
Warn
Audited by Gen Agent Trust Hub on Sep 16, 2026
Risk Level: MEDIUMEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill documentation instructs the user to clone a repository from GitHub (BeehiveInnovations/pal-mcp-server) which is not among the verified trusted organizations or well-known services.
- [REMOTE_CODE_EXECUTION]: The installation instructions for the MCP server recommend using the 'uvx' tool to execute code directly from a remote git repository (git+https://github.com/BeehiveInnovations/pal-mcp-server.git) at runtime.
- [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from code files and architecture diagrams. It lacks explicit boundary markers or sanitization in its documentation, while providing subagents ('clink') with high-privilege capabilities including file system and network access. This combination creates an attack surface where malicious content in analyzed files could influence the subagent's execution (Ingestion points: code/diagrams; Boundary markers: absent; Capability inventory: file access/network/commands; Sanitization: absent).
- [COMMAND_EXECUTION]: The 'clink' tool is designed to spawn and execute external CLI tools such as Gemini CLI, Codex CLI, and Claude Code as subagents with full CLI capabilities, which provides a pathway for the agent to execute shell commands.
Audit Metadata