ai-core/tool-calling
Pass
Audited by Gen Agent Trust Hub on Sep 27, 2026
Risk Level: SAFECOMMAND_EXECUTIONREMOTE_CODE_EXECUTIONINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill documents the use of
stdioTransportin the@tanstack/ai-mcp/stdiosubpath, which enables launching external processes via shell commands (e.g., usingnpxto initialize an MCP server). - [REMOTE_CODE_EXECUTION]: The documentation covers the integration of Model Context Protocol (MCP), allowing the agent to dynamically discover, load, and invoke tools hosted on remote servers via HTTP or SSE transports.
- [EXTERNAL_DOWNLOADS]: The skill references and utilizes multiple packages within the
@tanstackecosystem (e.g.,@tanstack/ai,@tanstack/ai-mcp) and describes connecting to external MCP server endpoints. - [INDIRECT_PROMPT_INJECTION]: The described system ingests data from external sources including databases, remote APIs, and third-party MCP servers, creating an attack surface for indirect prompt injection.
- Ingestion points: Data entering via
db.products.searchintools/server.ts, thefetchcall in thefetchReporttool, and tools discovered viamcp.tools(). - Boundary markers: The skill prominently uses Zod schemas (
inputSchema,outputSchema) to define structured data boundaries and validation rules. - Capability inventory: The documented system supports network requests (
fetch, MCP clients), local subprocess execution (stdioTransport), and provider-managed sandboxed code execution (codeExecutionTool,shellTool). - Sanitization: Content is validated against the definitions' Zod schemas before being passed to the model or executed, which serves as a primary sanitization layer.
Audit Metadata