mcp-openapi-typescript-stack
Pass
Audited by Gen Agent Trust Hub on Oct 23, 2026
Risk Level: SAFE
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill references a GitHub template repository
atomicpages/mcp-templatefor scaffolding new projects. This is a vendor-owned resource used for legitimate development purposes. - [COMMAND_EXECUTION]: Instructions include standard development commands for project initialization and building, such as
bun install,bun run build, and running theopenapi-tscode generator. - [INDIRECT_PROMPT_INJECTION]: As the skill describes an architecture for servers that process external API data and user-provided tool parameters, it acknowledge the potential attack surface. It mitigates this by strongly recommending Zod-based request validation and providing specific logic to ensure write-operations require explicit user confirmation via the
readOnlyHintflag. - [DATA_EXPOSURE_AND_EXFILTRATION]: The skill provides explicit guidance on avoiding data exposure, specifically warning against logging
Authorizationheaders or raw secrets and recommending that all debug output be sent tostderrwith a stable, grep-able prefix. - [DYNAMIC_EXECUTION]: Recommends the use of dynamic
import()statements specifically for edge runtimes (like Cloudflare Workers) to manage CPU startup budgets during module evaluation. This is a standard performance optimization technique and does not involve executing untrusted strings.
Audit Metadata