laravel-plugin-discovery
Pass
Audited by Gen Agent Trust Hub on Oct 5, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill connects to a third-party MCP server at
https://laraplugins.io/mcp/pluginsto fetch package metrics and metadata. - [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted external data which can influence the agent's behavior.
- Ingestion points: Data is received through the
SearchPluginToolandGetPluginDetailsTool, including package descriptions and README content (SKILL.md). - Boundary markers: The instructions do not define specific delimiters or warnings to prevent the agent from following instructions potentially embedded in the package metadata.
- Capability inventory: The agent uses the outputs of these tools to evaluate package health and provide recommendations to the user.
- Sanitization: There is no mention of sanitization or filtering applied to the external text before it enters the agent context.
Audit Metadata