pi-mcp-adapter
Pass
Audited by Gen Agent Trust Hub on Sep 16, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill facilitates the ingestion of data from external MCP servers (such as GitHub, search, and filesystem servers), creating a vulnerability surface where unvalidated third-party content can influence the assistant's behavior. Ingestion points: Metadata and content from external tools enter the agent context. Boundary markers: No explicit instructions describe the isolation of tool outputs. Capability inventory: The skill enables broad system capabilities including command execution and filesystem access. Sanitization: No sanitization of output from external tools is discussed.
- [COMMAND_EXECUTION]: The adapter executes CLI tools and binaries (e.g., via npx) defined in JSON configuration files.
- [EXTERNAL_DOWNLOADS]: The skill documentation describes installing the adapter and associated servers from the public npm registry.
- [DYNAMIC_EXECUTION]: The skill dynamically loads and executes code specified in .mcp.json files, which could lead to unauthorized command execution if local configuration files are maliciously altered. The 'samplingAutoApprove' configuration specifically allows skipping of user confirmation, which reduces oversight of the model's autonomous operations.
Audit Metadata