mcp-manager
Pass
Audited by Gen Agent Trust Hub on Nov 2, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill translates natural language requests into shell commands by interpolating user-provided data (e.g., server names, binary commands, and arguments) directly into a command string for execution via
python3 -m mcp-manager.cli. This approach creates a command injection risk if input containing shell metacharacters like semicolons, backticks, or pipes is not rigorously sanitized. - [INDIRECT_PROMPT_INJECTION]: The skill processes potentially untrusted data to define executable server configurations.
- Ingestion points: User-provided strings for server names, command paths, and arguments captured during the 'Add MCP' flow in
SKILL.md. - Boundary markers: None identified; user input is directly interpolated into the execution template.
- Capability inventory: Subprocess execution via shell (
python3 -m mcp-manager.cli) across multiple configuration commands. - Sanitization: While the skill suggests validating names, it lacks explicit requirements for escaping or sanitizing shell metacharacters in user-provided commands and environment variable values.
Audit Metadata