mcp-setup
Pass
Audited by Gen Agent Trust Hub on Jun 22, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill uses the
claude mcp addcommand-line interface to register new tools, which involves executing shell commands and modifying local configuration files. - [EXTERNAL_DOWNLOADS]: Fetches and executes code from well-known package registries via
npx, including@upstash/context7-mcpfrom Upstash andexa-mcp-serverfrom Exa. - [EXTERNAL_DOWNLOADS]: Downloads and runs the GitHub MCP server container from the official GitHub Container Registry (
ghcr.io/github/github-mcp-server). - [EXTERNAL_DOWNLOADS]: References an official Model Context Protocol filesystem server package (
@modelcontextprotocol/server-filesystem) for extended file access. - [PROMPT_INJECTION]: The skill exhibits an indirect prompt injection surface in the 'Custom MCP Server' configuration section where user-supplied strings are used to construct shell commands.
- Ingestion points: User input gathered via
AskUserQuestionfor server names, commands, arguments, and environment variables. - Boundary markers: No explicit delimiters or instructions are used to prevent the agent from obeying commands embedded in user input.
- Capability inventory: Shell command execution via
claude mcp addin SKILL.md. - Sanitization: No input validation or escaping mechanisms are defined to sanitize user-provided strings before interpolation into shell commands.
Audit Metadata