faf-wizard
Warn
Audited by Gen Agent Trust Hub on Aug 10, 2026
Risk Level: MEDIUMEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill instructions recommend the installation of global NPM packages (
faf-cli) and the use ofnpx -y claude-faf-mcp@latestto set up an MCP server. These resources originate from third-party sources that are not verified or recognized as trusted.\n- [REMOTE_CODE_EXECUTION]: The use ofnpx -yto execute theclaude-faf-mcppackage constitutes a remote code execution pattern, as it downloads and runs code from the NPM registry in a single step without version pinning or source verification.\n- [COMMAND_EXECUTION]: The provided workflow guides users to execute multiple shell commands (faf auto,faf migrate,faf sync) using a third-party CLI tool, which may perform arbitrary operations on the local file system or network.\n- [PROMPT_INJECTION]: The skill describes a tool that ingests untrusted data from project files to influence AI behavior, presenting an indirect prompt injection risk.\n - Ingestion points: The tool scans project manifest files (e.g.,
package.json,Cargo.toml,pyproject.toml), directory structures, andREADME.mdfiles as part of its Phase 1 and Phase 2 detection process.\n - Boundary markers: There are no instructions or delimiters specified to ensure that the agent ignores commands or instructions embedded within the scanned project files.\n
- Capability inventory: The skill involves the execution of a CLI tool and an MCP server that can read project files and generate context files (
project.faf) used by multiple AI platforms.\n - Sanitization: The skill does not mention any validation, filtering, or escaping mechanisms to sanitize the content extracted from untrusted external sources before it is processed by the AI.
Audit Metadata