mcp-tool-discovery
Pass
Audited by Gen Agent Trust Hub on Sep 6, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill directs the agent to ingest and act upon tool metadata (names and descriptions) fetched from a ServiceNow instance via the
tool_searchmeta-tool. If this external content is controlled by an adversary, it could potentially contain instructions aimed at influencing the agent's behavior during tool selection and execution. - Ingestion points: Metadata returned by the ServiceNow MCP server via
tool_search(SKILL.md). - Boundary markers: The instructions do not specify any delimiters or safety prompts to ignore instructions found within tool descriptions.
- Capability inventory: The skill enables the
tool_executecapability, which allows for data modification on the ServiceNow instance (SKILL.md). - Sanitization: No sanitization or verification of the external tool schema or description text is mentioned.
- [COMMAND_EXECUTION]: The documentation provides configuration examples for launching the
@serac-labs/servicenow-mcppackage usingnpx. This is the official server implementation from the vendor (serac-labs) used to establish the MCP connection. - [PERSISTENCE]: The skill describes how the server persists enabled tool state to the local filesystem (e.g.,
~/Library/Application Support/snow-code/on macOS). This is standard application behavior for maintaining session state and does not constitute an unauthorized persistence mechanism.
Audit Metadata