mcp-apps-protocol
Pass
Audited by Gen Agent Trust Hub on Aug 13, 2026
Risk Level: SAFE
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill defines a protocol for processing external data within a sandboxed UI environment. It correctly identifies the attack surface where untrusted
structuredContentfrom a server is rendered in the View. - Ingestion points: The
ui/notifications/tool-resultmethod delivers server-provided content to the View (SKILL.md). - Boundary markers: The documentation explicitly instructs developers to treat all incoming content as untrusted.
- Capability inventory: The View is restricted to a specific JSON-RPC bridge for host communication (
tools/call,ui/message,ui/update-model-context). - Sanitization: The specification mandates rendering content as text and explicitly prohibits the use of
innerHTMLorevalto prevent code execution vulnerabilities. - [SAFE]: The skill is purely informational/reference-based and does not contain any executable scripts, binary files, or installation commands. It promotes secure development practices such as restrictive CSP headers and iframe sandboxing.
Audit Metadata