helix-mcp-impact-positioning
Pass
Audited by Gen Agent Trust Hub on Oct 25, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONMETADATA_POISONING
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill connects to a hosted MCP server at https://impact.gtmhelix.com/mcp and references a specific npm package (@shashwatgtmalpha/impact-mcp) and GitHub repository. These resources align with the author context (shashwatgtm) and are appropriate for the skill's functionality.
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted user data regarding markets and competitors. However, it implements exceptional defensive measures in its 'Operating Principles', requiring the agent to independently verify competitive relationships and URL existence using web_search and web_fetch tools before generating any content.
- [COMMAND_EXECUTION]: Provides clear CLI instructions for users to manually register the MCP server with tools like Claude Code or Gemini CLI. These are standard integration steps and do not involve automated or suspicious shell execution.
- [METADATA_POISONING]: A minor documentation inconsistency was noted where the SKILL.md specifies an MIT license while the referenced operating principles are marked as proprietary. This appears to be a template artifact and poses no security risk to the user or the environment.
Audit Metadata