express-mcp
Fail
Audited by Gen Agent Trust Hub on Feb 17, 2026
Risk Level: HIGHEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONCOMMAND_EXECUTION
Full Analysis
- [Unverifiable Dependencies & Remote Code Execution] (HIGH): The skill clones a repository from
https://github.com/Eng0AI/express-mcp.git, which is not a trusted source. It then instructs the user to runnpm installandnpm run dev, which can execute arbitrary code (e.g., via npm scripts) contained within the untrusted repository. - [Command Execution] (MEDIUM): The skill utilizes shell commands to manipulate the file system and initialize Git, which increases the risk if the downloaded content contains malicious payloads designed to exploit these operations.
Recommendations
- AI detected serious security threats
Audit Metadata