smalltv-mcp-tools
Pass
Audited by Gen Agent Trust Hub on Aug 1, 2026
Risk Level: SAFECOMMAND_EXECUTIONDATA_EXFILTRATIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill utilizes local MCP tools to execute commands on the host system to interact with the SmallTV hardware. This includes the ability to flash firmware via the smalltv-upload-firmware tool, which is an intended feature with documented safety confirmations.
- [DATA_EXFILTRATION]: The skill references local configuration data stored in environment variables (SMALLTV_IP) and local files (.claude/geekmagic-smalltv-ultra.local.md). It also accesses local image files for upload to the device.
- [PROMPT_INJECTION]: The skill processes data returned from the device's network endpoints, presenting an indirect injection surface. 1. Ingestion points: Data retrieved from /v.json, /space.json, and /filelist via the smalltv-read tool. 2. Boundary markers: No explicit delimiters or warnings are defined for the received JSON data. 3. Capability inventory: The skill can execute device commands, upload files, and update firmware. 4. Sanitization: The skill does not specify sanitization or validation of the device's responses before processing them.
Audit Metadata