mcp-server-sv-number
Pass
Audited by Gen Agent Trust Hub on Aug 14, 2026
Risk Level: SAFE
Full Analysis
- [COMMAND_EXECUTION]: The skill uses
npxto run a known package (sv-number-mcp) and standard Node.js version checks. These are routine development operations. - [CREDENTIALS_UNSAFE]: The instructions correctly advise against hardcoding API keys, instead requiring them to be set via environment variables (
SVN_API_KEY). It uses placeholders likeyour_key_herein examples, which is a safe practice. - [EXTERNAL_DOWNLOADS]: The skill downloads the
sv-number-mcppackage vianpxfrom the official npm registry. This is a standard and safe method for utilizing Node.js tools. - [DATA_EXFILTRATION]: While the skill interacts with a remote API (
sms-verification-number.com), it does so using a defined toolset for the skill's primary purpose. No evidence of unauthorized sensitive data access or transmission was found. - [DYNAMIC_EXECUTION]: The
totp_codetool computes authenticator codes locally from a secret. The documentation explicitly states this tool does not make network calls, keeping sensitive secrets on the local machine.
Audit Metadata