synter-mcp-setup
Pass
Audited by Gen Agent Trust Hub on Oct 13, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill instructs the user to install the
@synterai/mcp-serverpackage from the NPM registry and provides links to the vendor's GitHub repository (Synter-Media-AI/free-skills). These resources are managed by the skill's author and are standard for the intended functionality. - [COMMAND_EXECUTION]: The setup instructions include
npxcommands (e.g.,npx -y @synterai/mcp-server init) to initialize the MCP server and configure client settings. These commands are necessary for the installation and configuration of the tool. - [INDIRECT_PROMPT_INJECTION]: The skill establishes a workflow where the agent ingests external data (ad performance metrics) from platforms like Google, Meta, and LinkedIn.
- Ingestion points: External ad platform APIs (Google Ads, Meta Ads, LinkedIn, etc.) via the MCP server (referenced in
SKILL.md). - Boundary markers: The skill explicitly instructs the agent that "Human approve ≠ activate," requiring human confirmation for any spend-related actions, which serves as a procedural boundary.
- Capability inventory: The skill enables the agent to pull performance data, draft campaigns, sync audiences, and configure pixels via the
synterai/mcp-serverCLI and HTTP interface. - Sanitization: The skill relies on the human-in-the-loop approval process rather than explicit technical sanitization of the ingested ad data.
Audit Metadata