storybook-mcp-integration
Pass
Audited by Gen Agent Trust Hub on Sep 16, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill defines a 'Self-heal' pattern in
rules/mcp-test-runner.mdthat creates a vulnerability surface. The agent is instructed to ingest output from therun-story-teststool (specifically failure details and accessibility violations) and use that data to automatically modify source code using theEditorWritetools. - Ingestion points: Tool output from
run-story-testsas described inrules/mcp-test-runner.md. - Boundary markers: No explicit delimiters or warnings to ignore embedded instructions within the test results are present.
- Capability inventory: The skill utilizes
WriteandEdittools to perform automated file modifications based on the ingested data. - Sanitization: No sanitization or validation logic is specified for the ingested test failure data before it influences code generation.
- [EXTERNAL_DOWNLOADS]: The skill provides instructions to download and install official packages from the Storybook ecosystem.
- Fetches the
@storybook/addon-mcpand@storybook/mcppackages vianpxandnpmas documented inSKILL.md. - References the
https://chromatic.storybook.cloudregistry, which is an established service for Storybook hosting. - [COMMAND_EXECUTION]: The documentation includes shell commands required to set up the Storybook environment and register the MCP server.
- Instructions include execution of
npx storybook@latest upgrade,npx storybook add, andnpx mcp-addfor project configuration.
Audit Metadata