masterkala
Pass
Audited by Gen Agent Trust Hub on Oct 24, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill instructions direct the user to install the
masterkala-mcppackage using theuvxtool (e.g.,uvx masterkala-mcp). This involves downloading and executing code from an external package registry. - [INDIRECT_PROMPT_INJECTION]: The skill provides tools that ingest data from the MasterKala website, including user-generated content like comments and reviews, which could contain malicious instructions.
- Ingestion points: Tools such as
mk_blog_commentsandmk_reviews(defined inSKILL.md) fetch data from external threads and customer reviews. - Boundary markers: There are no instructions or delimiters provided to the agent to distinguish between system instructions and data fetched from the external site.
- Capability inventory: The skill includes capabilities to search products, read blog posts, and fetch shipping information.
- Sanitization: No sanitization, filtering, or validation of the fetched external content is described in the skill's instructions.
Audit Metadata