elaichi-mcp

Pass

Audited by Gen Agent Trust Hub on Sep 17, 2026

Risk Level: SAFEINDIRECT_PROMPT_INJECTIONNO_CODE
Full Analysis
  • [INDIRECT_PROMPT_INJECTION]: The skill facilitates the processing of data from third-party SaaS accounts (e.g., Jira, Slack, HubSpot), which constitutes an indirect prompt injection surface as these external sources may contain untrusted instructions.
  • Ingestion points: Data retrieved via execute_tool from connected third-party APIs (referenced in SKILL.md and tool-discovery.md).
  • Boundary markers: The documentation in scopes-and-refusals.md explicitly states that the Elaichi MCP server does not provide a write-gate for prompt injection and delegates defense to the client.
  • Capability inventory: The agent can perform write and destructive actions on SaaS data and modify organization-level settings such as member deletion (referenced in operations-catalog.md).
  • Sanitization: The skill mitigates risks by instructing the agent to confirm with the user before performing any write operations and strictly prohibits the handling of passwords or API keys.
  • [NO_CODE]: The analyzed skill consists entirely of Markdown documentation and reference materials; no executable code or scripts are included in the package.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 17, 2026, 04:58 PM
Security Audit — agent-trust-hub — elaichi-mcp