vulnerable-mcp-servers-lab
Warn
Audited by Gen Agent Trust Hub on Sep 16, 2026
Risk Level: MEDIUMEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONPROMPT_INJECTIONCREDENTIALS_UNSAFEINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill instructs the user to clone an external repository (github.com/appsecco/vulnerable-mcp-servers-lab.git), which contains intentionally vulnerable and unverified codebases for lab use.
- [REMOTE_CODE_EXECUTION]: Instructions describe the implementation and exploitation of tools using
eval()andexecSync()on attacker-controlled inputs to demonstrate code execution vulnerabilities. - [COMMAND_EXECUTION]: Provides specific code examples for system command execution using Python's
os.systemandsubprocesscalls within an unsandboxed lab environment. - [PROMPT_INJECTION]: The skill file contains multiple prompt injection patterns (e.g., 'Ignore previous instructions', 'You are now in admin mode') provided as testing payloads for AI red teaming exercises.
- [CREDENTIALS_UNSAFE]: Includes hardcoded dummy secrets, such as 'sk-hardcoded-secret-key-12345' and 'admin123', to illustrate common credential exposure vulnerabilities in source code.
- [INDIRECT_PROMPT_INJECTION]: Flags an attack surface where agents processing documents from tools like
search_documentsmay ingest hidden instructions. The skill documentation lacks sanitization steps or boundary marker enforcement for these ingestion points. - [DYNAMIC_EXECUTION]: The lab environment features components that dynamically compile or execute code strings via
eval()and unsandboxed Python tools as part of its educational vulnerability suite.
Audit Metadata