basecamp-automation
Pass
Audited by Gen Agent Trust Hub on Aug 10, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill requires adding a remote MCP server endpoint (
https://rube.app/mcp) to the client configuration. This enables the agent to interact with external tools and services hosted on that domain. - [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from external Basecamp project environments, creating a potential surface for indirect prompt injection.
- Ingestion points: Data enters the agent's context through tools like
BASECAMP_GET_MESSAGE,BASECAMP_GET_PROJECTS,BASECAMP_GET_PEOPLE, andBASECAMP_GET_BUCKETS_TODOLISTS_TODOS(SKILL.md). - Boundary markers: The instructions lack explicit boundary markers or directives for the agent to ignore instructions embedded within the data retrieved from Basecamp.
- Capability inventory: The skill possesses significant write capabilities, including task creation (
BASECAMP_CREATE_TODO), message posting (BASECAMP_CREATE_MESSAGE), and project access management (BASECAMP_PUT_PROJECTS_PEOPLE_USERS) across ALL scripts (SKILL.md). - Sanitization: There is no evidence of content sanitization, escaping, or validation for data ingested via the Basecamp API before it is interpolated into the agent's reasoning process.
Audit Metadata