mcp-vods
Warn
Audited by Gen Agent Trust Hub on Feb 25, 2026
Risk Level: MEDIUMEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONREMOTE_CODE_EXECUTIONPROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill uses
npx -yanduvxto fetch and execute packages (mcporterandmcp-vods) from npm and PyPI registries during runtime. - [COMMAND_EXECUTION]: The skill requires the agent to execute shell commands to interact with the mcporter tool and local TV devices.
- [REMOTE_CODE_EXECUTION]: By executing unpinned packages directly from public registries via
npxanduvx, the skill performs remote code execution where the specific code is determined by the registry state at the time of call. - [PROMPT_INJECTION]: The
vods_searchtool retrieves data from multiple third-party source sites, which creates a surface for indirect prompt injection. 1. Ingestion points: Results fromvods_searchin SKILL.md. 2. Boundary markers: Absent. 3. Capability inventory: Subprocess execution of npx and local network requests. 4. Sanitization: Not specified in the skill logic.
Audit Metadata