mcp-builder
Pass
Audited by Gen Agent Trust Hub on Feb 17, 2026
Risk Level: SAFE
Full Analysis
- [SAFE] (SAFE): Analysis of the skill documentation and associated scripts found no indicators of malicious activity, obfuscation, or unauthorized data access. The skill serves a legitimate educational and technical purpose.\n- [COMMAND_EXECUTION] (SAFE): The file
scripts/connections.pyprovides a factory for creating connections to MCP servers, including viastdio. This involves executing commands to spawn local server processes. This behavior is a fundamental part of the Model Context Protocol and is implemented using the officialmcplibrary.\n- [INDIRECT_PROMPT_INJECTION] (SAFE): TheSKILL.mdguide instructs the agent to fetch documentation from external sources such asmodelcontextprotocol.ioand GitHub. While this is an ingestion surface for untrusted content, it is required for the skill's primary purpose of research and planning.\n - Ingestion points:
WebFetchcalls to documentation URLs mentioned in Phase 1 of the implementation workflow.\n - Boundary markers: None; the agent is expected to synthesize technical documentation directly.\n
- Capability inventory: Local command execution via
stdio(inconnections.py) and file system access for project setup.\n - Sanitization: None; standard LLM processing is utilized for the fetched markdown content.
Audit Metadata