mcp-visual-output
Pass
Audited by Gen Agent Trust Hub on Sep 17, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill defines a system where an AI agent generates JSON specifications to be rendered as UI components. While this is an ingestion point for untrusted data, the skill provides comprehensive mitigation strategies:
- Ingestion points: Data enters via tool responses in the form of structured JSON specs, as seen in the catalog definitions in
references/mcp-integration.md. - Boundary markers: The skill uses
defineCatalogwith Zod schema validation to ensure the AI can only produce expected component structures and prop types, preventing the injection of malicious payloads (detailed inrules/mcp-app-setup.md). - Capability inventory: Rendering occurs within a sandboxed iframe with restricted permissions, and components are limited to a pre-defined registry, which prevents arbitrary code execution.
- Sanitization: Explicit rules for Content Security Policy (CSP) are provided in
rules/sandbox-csp.mdto block unauthorized network requests and script execution. - [EXTERNAL_DOWNLOADS]: The skill references standard, public NPM packages for the MCP and json-render ecosystems (e.g.,
@json-render/mcp,@modelcontextprotocol/sdk). These are legitimate dependencies for the functionality provided. - [SAFE]: The skill serves as a security-oriented guide, providing specific warnings against insecure practices such as using wildcard CSP domains or permissive script-src settings, aligning with best practices for AI-driven user interfaces.
Audit Metadata