mcp-builder
Pass
Audited by Gen Agent Trust Hub on Apr 12, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [SAFE]: The skill serves as a guide for building MCP servers and provides utility scripts for local testing and evaluation. All included scripts use official, verifiable libraries and adhere to common security standards.\n- [EXTERNAL_DOWNLOADS]: The skill includes instructions to fetch documentation from the official
modelcontextprotocol.iowebsite and themodelcontextprotocolorganization on GitHub. These downloads are from well-known and authoritative sources.\n- [COMMAND_EXECUTION]: The evaluation harness (scripts/evaluation.py) allows users to run local MCP servers via standard input/output (stdio). This process execution is a functional requirement for testing and is controlled by the user through command-line arguments.\n- [PROMPT_INJECTION]: The skill utilizes a system prompt for the evaluation phase to define the agent's behavior. While the script processes questions from an XML file—representing a surface for indirect prompt injection—this occurs within a local development context using user-provided data.\n- [DATA_EXFILTRATION]: No unauthorized data access or exfiltration patterns were detected. The skill correctly handles API keys using environment variables and limits network activity to the specified MCP server and the Anthropic API.
Audit Metadata