mcp-openapi-typescript-stack

Pass

Audited by Gen Agent Trust Hub on Oct 23, 2026

Risk Level: SAFE
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill references a GitHub template repository atomicpages/mcp-template for scaffolding new projects. This is a vendor-owned resource used for legitimate development purposes.
  • [COMMAND_EXECUTION]: Instructions include standard development commands for project initialization and building, such as bun install, bun run build, and running the openapi-ts code generator.
  • [INDIRECT_PROMPT_INJECTION]: As the skill describes an architecture for servers that process external API data and user-provided tool parameters, it acknowledge the potential attack surface. It mitigates this by strongly recommending Zod-based request validation and providing specific logic to ensure write-operations require explicit user confirmation via the readOnlyHint flag.
  • [DATA_EXPOSURE_AND_EXFILTRATION]: The skill provides explicit guidance on avoiding data exposure, specifically warning against logging Authorization headers or raw secrets and recommending that all debug output be sent to stderr with a stable, grep-able prefix.
  • [DYNAMIC_EXECUTION]: Recommends the use of dynamic import() statements specifically for edge runtimes (like Cloudflare Workers) to manage CPU startup budgets during module evaluation. This is a standard performance optimization technique and does not involve executing untrusted strings.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 23, 2026, 06:32 PM