mcp-release-qa
Pass
Audited by Gen Agent Trust Hub on Oct 24, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and act upon data from external MCP servers and local project files, creating an attack surface for instructions embedded in untrusted data.
- Ingestion points: Results from protocol discovery methods (tools/list, resources/list, prompts/list) and repository files (README.md, package.json, pyproject.toml) found in SKILL.md sections 1, 3, and 5.
- Boundary markers: The skill does not define specific delimiters or instructions to ignore potential commands within the ingested data.
- Capability inventory: The agent is instructed to run build commands, start server processes, and execute installation strings (SKILL.md sections 2 and 7).
- Sanitization: While the skill explicitly instructs the redaction of credentials and environment variables (Section 2), it does not specify sanitization for natural language instructions that might be present in tool descriptions or resource templates.
- [COMMAND_EXECUTION]: The skill requires the execution of shell commands found within the project's documentation and configuration files.
- Evidence: Section 7 ("Run the public install command exactly as documented") and Section 2 ("Build the candidate and start the documented entry point") in SKILL.md.
- Context: These operations are core to the skill's purpose of verifying release readiness, but they rely on the assumption that the project's own documentation is trustworthy.
Audit Metadata