skills/xberg-io/tree-sitter-language-pack/tree-sitter-language-pack-using-the-mcp-server/Gen Agent Trust Hub
tree-sitter-language-pack-using-the-mcp-server
Pass
Audited by Gen Agent Trust Hub on Oct 15, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill's launcher script, scripts/mcp-launch.sh, can automatically download a prebuilt binary of the ts-pack tool from its GitHub releases if it is not already available on the system.
- [REMOTE_CODE_EXECUTION]: The skill facilitates the execution of the ts-pack binary, which may be downloaded from its official GitHub repository, to provide syntax parsing and code analysis features.
- [COMMAND_EXECUTION]: The skill uses a bundled launcher script to execute the ts-pack mcp command, starting the server for communication with the AI agent.
- [INDIRECT_PROMPT_INJECTION]: The parsing tools (parse, process, detect_language) take source code and file paths as input, which is the primary purpose of the skill. While this creates a theoretical surface for malicious code to influence the agent, the risk is managed by the specific nature of the code intelligence extraction.
- Ingestion points: The source parameter for parse and process, and the content/path parameters for detect_language.
- Boundary markers: No explicit delimiters or instructions are provided to the agent to treat the ingested code as data only.
- Capability inventory: Extracting syntax trees, symbols, and code structure.
- Sanitization: The input is processed by the underlying tree-sitter language parsers.
Audit Metadata