mcp-builder
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFECOMMAND_EXECUTIONDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [DYNAMIC_EXECUTION]: The skill utilizes FastMCP.from_openapi to generate tool schemas and logic dynamically at runtime from OpenAPI specifications, as demonstrated in assets/openapi-integration.py.
- [INDIRECT_PROMPT_INJECTION]: The server templates in assets/tools-examples.py and assets/self-contained-server.py define tools that process user input without sanitization. Ingestion points: Parameters in search and data processing tools. Boundary markers: Absent in provided templates. Capability inventory: Network access via httpx, file system writes in CLI templates, and shell execution via mcp.run. Sanitization: Absent or basic string processing.
- [COMMAND_EXECUTION]: The skill provides commands for the agent to install dependencies, compile code for syntax checks, and manage server processes.
- [EXTERNAL_DOWNLOADS]: The skill initiates downloads of the FastMCP framework and its associated libraries from PyPI.
Audit Metadata