sdl-mcp-symbol-delta-ledger
Pass
Audited by Gen Agent Trust Hub on Sep 16, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The
sdl.runtime.executetool enables the agent to run subprocesses. While it implements acwdJailandallowedExecutablespolicy (defaulting to npm, node, and python3), this provides a mechanism for arbitrary code execution if the agent is misled or the configuration is broad. - [EXTERNAL_DOWNLOADS]: The installation process involves downloading third-party packages from NPM (
sdl-mcp) and utilizesnpxfor setup, introducing standard supply chain risks for external dependencies. - [INDIRECT_PROMPT_INJECTION]: The skill represents a vulnerability surface as it ingests untrusted data (source code from the local repository) and provides the agent with high-privilege capabilities (file reading and command execution). An attacker could place malicious instructions in code comments to influence the agent's behavior when it indexes or reads those files.
- [DYNAMIC_EXECUTION]: The skill facilitates runtime execution of code through its test execution and runtime tools, which can execute dynamically generated scripts if the agent is instructed to write them to disk first.
Audit Metadata