mcp-creator
Pass
Audited by Gen Agent Trust Hub on Nov 10, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill provides structured educational content and guidance for the Model Context Protocol (MCP) without any detected malicious patterns or bypass attempts. All instructions follow standard development practices.
- [EXTERNAL_DOWNLOADS]: The skill references official MCP resources, including the Python SDK and documentation hosted on github.com/modelcontextprotocol and modelcontextprotocol.io. These are well-known technology domains and are documented neutrally.
- [COMMAND_EXECUTION]: Includes a Python linter (
scripts/check_mcp_conformance.py) for static analysis of server source code. The script operates purely as a heuristic linter using regular expressions to flag legacy patterns and does not perform network operations or unsafe code execution. - [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and audit third-party MCP server source code. 1. Ingestion points: User-provided server source files and documentation. 2. Boundary markers: The instructions lack explicit prompt delimiters for the processed code content. 3. Capability inventory: File reading, code analysis, and local script execution. 4. Sanitization: The risk of indirect injection from audited code is mitigated through detailed developer security guidelines in references/security.md. This surface is a known factor for auditing tools and is managed through instructional safety practices.
Audit Metadata