Skills
Navigate
skills/aahl/skills/mcp-duckgo/Gen Agent Trust Hub

mcp-duckgo

Pass

Audited by Gen Agent Trust Hub on Sep 15, 2026

Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
  • [INDIRECT_PROMPT_INJECTION]: The skill uses the fetch_content capability to scrape data from external websites. This content is untrusted and could contain hidden instructions that manipulate the agent's logic. \n
  • Ingestion points: The output of the fetch_content command in SKILL.md. \n
  • Boundary markers: None are defined to separate external data from system instructions. \n
  • Capability inventory: The skill can execute shell commands via npx and uvx. \n
  • Sanitization: There is no evidence of filtering or validation of the scraped content. \n- [EXTERNAL_DOWNLOADS]: The skill uses npx -y and uvx to download and run the mcporter and duckduckgo-mcp-server packages from public registries. These are unversioned dependencies fetched during execution. \n- [COMMAND_EXECUTION]: The skill performs its primary search and fetch functions by executing shell commands.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 15, 2026, 03:23 PM
Security Audit — agent-trust-hub — mcp-duckgo