create-mcp-servers
Pass
Audited by Gen Agent Trust Hub on Feb 15, 2026
Risk Level: LOWCOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION] (LOW): The skill executes local initialization scripts (
setup-python-project.sh,setup-typescript-project.sh) and theclaude mcpCLI. These are required for project setup and server registration. The troubleshooting guide suggests persisting environment variables in~/.zshrc, which is a standard configuration step. - [EXTERNAL_DOWNLOADS] (LOW): Setup scripts install standard libraries (
mcp,@modelcontextprotocol/sdk) and development tools from official registries (PyPI, npm). Per [TRUST-SCOPE-RULE], these are categorized as LOW risk. - [CREDENTIALS_UNSAFE] (SAFE): The skill mandates the use of environment variables and specifically warns against hardcoding secrets or sharing them in chat, adhering to security best practices.
- [PROMPT_INJECTION] (SAFE): No prompt injection or behavior override patterns were detected. The skill uses well-defined instruction boundaries and natural language.
Audit Metadata