bootstrap-mcp-oauth
Pass
Audited by Gen Agent Trust Hub on Oct 4, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: No malicious patterns, obfuscation, or unauthorized data access behaviors were detected. The skill serves its primary purpose of scaffolding authentication infrastructure.
- [EXTERNAL_DOWNLOADS]: The skill configuration templates include references to well-known and established technology services (such as Claude, ChatGPT, and VS Code) for the purpose of defining legitimate OAuth redirect URI allow-lists.
- [CREDENTIALS_UNSAFE]: Example configurations use static UUID placeholders for client identifiers. It does not contain hardcoded secrets or sensitive credentials.
- [INDIRECT_PROMPT_INJECTION]: While the skill establishes an interface for processing external data (OAuth registration and authorization requests), it provides comprehensive instructions for mitigating injection risks through strict redirect validation, mandatory PKCE S256, and granular scope enforcement.
Audit Metadata