configure-mcp

Fail

Audited by Gen Agent Trust Hub on Mar 5, 2026

Risk Level: HIGHREMOTE_CODE_EXECUTIONEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
  • [REMOTE_CODE_EXECUTION]: The skill automates the execution of remote code by configuring MCP servers to run via npx, bunx, uvx, and go run using configurations defined in REFERENCE.md.\n
  • It references third-party GitHub repositories for execution, such as https://github.com/BeehiveInnovations/pal-mcp-server.git.\n
  • It installs and executes unversioned or @latest packages from registries (e.g., argocd-mcp, cclsp, @upstash/context7-mcp).\n
  • The --fix argument allows the agent to perform these installations automatically without requiring user confirmation for each server.\n- [EXTERNAL_DOWNLOADS]: The skill triggers downloads of executable content and configurations from external sources.\n
  • Fetches packages from NPM, PyPI, and Go registries.\n
  • Clones or runs code directly from GitHub repositories (e.g., github.com/github/github-mcp-server).\n- [COMMAND_EXECUTION]: The skill uses the Bash tool to perform project discovery and environment setup.\n
  • Uses find, jq, and grep to inspect local files and configuration.\n
  • Recommends the execution of global package installation commands (e.g., npm i -g typescript-language-server, pip install python-lsp-server) which may require elevated privileges.\n- [PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection through its ingestion of untrusted project data.\n
  • Ingestion points: Reads and parses .mcp.json, .project-standards.yaml, and various source files (*.ts, *.py, etc.) via find and jq to determine project context.\n
  • Boundary markers: No explicit boundary markers or instructions to ignore embedded commands are present when parsing these files.\n
  • Capability inventory: The skill possesses Bash, Write, and Edit capabilities, enabling it to execute commands and modify the filesystem based on project configuration.\n
  • Sanitization: No sanitization or validation logic is defined for the content extracted from the project files before it is used in the configuration workflow.
Recommendations
  • AI detected serious security threats
Audit Metadata
Risk Level
HIGH
Analyzed
Mar 5, 2026, 12:47 PM