skills/zackbart/skills/mcp-sync/Gen Agent Trust Hub

mcp-sync

Pass

Audited by Gen Agent Trust Hub on Jul 7, 2026

Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill utilizes the claude CLI and the jq utility to inspect and modify local configuration data in ~/.claude.json. These commands are restricted to managing Model Context Protocol (MCP) server settings within a project-specific scope.
  • [PROMPT_INJECTION]: The skill ingest configuration data from a local MCP.md file. While this represents a surface for indirect prompt injection, the instructions mitigate risk by mandating user review and confirmation before applying any changes or removals to the tool configurations.
  • [SAFE]: The skill provides clear guidance on maintaining security boundaries, such as excluding sensitive data from shared manifests and keeping environment-specific configurations out of version control. It uses standard tool interfaces for modifications rather than performing unsafe direct edits on sensitive system-wide configuration files.
Audit Metadata
Risk Level
SAFE
Analyzed
Jul 7, 2026, 01:06 AM
Security Audit — agent-trust-hub — mcp-sync