mcp-quickstart-scaffolder
Pass
Audited by Gen Agent Trust Hub on Jun 23, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill facilitates the download and execution of the "mcp-quickstart" package from the public npm registry. It also provides examples for fetching OpenAPI definitions from remote endpoints (e.g., "petstore3.swagger.io") during the code generation process.
- [COMMAND_EXECUTION]: Multiple shell commands are provided for project initialization ("npm create"), package management ("npm install", "uv sync"), and deployment ("npx wrangler"). These commands are standard for the described development workflow and necessary for the tool's functionality.
- [SAFE]: The skill includes placeholders for sensitive information (e.g., "YOUR_API_KEY") and correctly advises using environment variables or Cloudflare Workers secrets for credential management in the generated projects. No attempts to exfiltrate data or bypass safety guidelines were found.
Audit Metadata