mcp-app-builder
Pass
Audited by Gen Agent Trust Hub on Oct 3, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [SAFE]: No malicious patterns, command injection, or obfuscation techniques were identified in the skill content.- [EXTERNAL_DOWNLOADS]: Skill references official documentation and release notes for the Skybridge framework at skybridge.tech and github.com/alpic-ai. These are official resources belonging to the skill author (alpic-ai).- [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest application requirements from developer-controlled files. 1. Ingestion points: Reads requirements and design decisions from SPEC.md. 2. Boundary markers: None identified in this guidance document. 3. Capability inventory: Mentions bootstrapping projects, running dev servers, and deploying apps (SKILL.md). 4. Sanitization: Not specified in the instruction file. While this represents an untrusted data surface, it is a necessary component of the skill's intended development workflow.
Audit Metadata