bgpt-paper-search
Pass
Audited by Gen Agent Trust Hub on Sep 14, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill requires the installation of the bgpt-mcp and mcp-remote packages from the official NPM registry.
- [REMOTE_CODE_EXECUTION]: Instructions recommend running the server via npx bgpt-mcp or npx mcp-remote, which executes code directly from the NPM registry.
- [INDIRECT_PROMPT_INJECTION]: The skill retrieves structured scientific data, including conclusions and methodologies, from the bgpt.pro database. This processing of external study content constitutes an attack surface where malicious instructions could be embedded within the scientific text.
Audit Metadata