using-the-mcp-server
Pass
Audited by Gen Agent Trust Hub on Aug 22, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill uses a launcher script (
scripts/mcp-launch.sh) documented to download a prebuilt binary from the tool's GitHub release if it is not found on the local path or via package managers like npx, uvx, or Homebrew. - [REMOTE_CODE_EXECUTION]: The launcher script is designed to execute the
html-to-markdownbinary immediately after resolving or downloading it. Executing binaries downloaded from external sources at runtime presents a significant security risk if the source repository or delivery channel is compromised. - [COMMAND_EXECUTION]: The skill documentation details the manual and automatic execution of shell commands, specifically
html-to-markdown mcp, to initialize the MCP server. - [PROMPT_INJECTION]: The
convert_htmlandextract_metadatatools ingest arbitrary HTML strings, creating a surface for indirect prompt injection where malicious instructions embedded in the HTML could influence the agent's behavior. - Ingestion points: The
htmlparameter in bothconvert_htmlandextract_metadatatools. - Boundary markers: None identified in the documentation to isolate untrusted HTML input.
- Capability inventory: The skill executes local binaries via the bundled launcher script.
- Sanitization: No input sanitization or validation of the HTML content is described.
Audit Metadata