mcp-builder
Pass
Audited by Gen Agent Trust Hub on May 14, 2026
Risk Level: SAFEPROMPT_INJECTIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The evaluation script
scripts/evaluation.pyprocesses data from external MCP servers and passes it back to the AI model, which creates a potential attack surface for instructions embedded in tool outputs. - Ingestion points: Results from external tool calls are ingested in the
agent_loopfunction ofscripts/evaluation.py. - Boundary markers: Data is passed using standard API structures, but the system prompt lacks specific delimiters or warnings to disregard potential instructions in tool results.
- Capability inventory: The skill can execute local commands (to run servers) and perform network requests (via SSE/HTTP).
- Sanitization: No sanitization or filtering is applied to tool outputs before they are provided to the model.
- [REMOTE_CODE_EXECUTION]: The skill's evaluation harness in
scripts/evaluation.pyis designed to execute shell commands to launch local MCP servers. Additionally, the skill's documentation guides involve fetching content from trusted remote sources including the officialmodelcontextprotocol.iodomain and its related GitHub repositories.
Audit Metadata