mcp-cli
Fail
Audited by Gen Agent Trust Hub on Feb 16, 2026
Risk Level: HIGHCOMMAND_EXECUTIONDATA_EXFILTRATION
Full Analysis
- [Command Execution] (HIGH): The skill documentation includes examples that pipe external tool output directly into shell commands via
sh -c. Evidence: Use ofxargs -I {} sh -cto process file paths inSKILL.md. This is a classic shell injection vector if the tool output contains malicious shell metacharacters. - [Indirect Prompt Injection] (HIGH): The skill lacks security controls for processing data from external MCP servers. 1. Ingestion:
mcp-clitool outputs are fed back into the agent context. 2. Boundary markers: Absent in instructions. 3. Capability: Filesystem, API, and DB interaction via the CLI. 4. Sanitization: No evidence of escaping or validation. - [Data Exposure] (MEDIUM): The tool is designed to expose local files and databases to the model, which can be misused to access sensitive credentials or private information like
~/.sshor environment variables if the agent is misled by external data.
Recommendations
- AI detected serious security threats
Audit Metadata