aps-mcp-server-gen
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [SAFE]: The skill provides legitimate scaffolding for Model Context Protocol (MCP) servers integrated with Autodesk Platform Services (APS), supporting multiple languages (Node.js, .NET, Python) and transport layers (STDIO, HTTP).
- [SAFE]: Implements secure authentication patterns, including Secure Service Accounts (SSA) using local JWT signing with RSA private keys, and strictly prohibits insecure token passthrough patterns.
- [SAFE]: Encourages industry-standard credential management by directing users to store sensitive secrets (APS_CLIENT_SECRET, RSA private keys) in environment variables or
.envfiles. - [SAFE]: All external references target official Autodesk developer domains (developer.api.autodesk.com) or well-known package registries (NPM, PyPI, NuGet), and use standard libraries for their intended purposes.
- [INDIRECT_PROMPT_INJECTION]: The generated server templates for listing Object Storage Service (OSS) resources possess a vulnerability surface for indirect prompt injection from API-supplied data.
- Ingestion points: Data is ingested from the APS OSS API via tools such as
list_bucketsandlist_objects(e.g., insrc/aps/oss.pyandsrc/tools/oss.ts). - Boundary markers: The generated output logic (e.g., the Node.js tool callback or Python FastMCP return values) does not implement explicit delimiters or wrappers to separate potentially untrusted bucket or object names from the agent's instructions.
- Capability inventory: The generated servers have the capability to perform network operations and read metadata from the cloud, which is then interpolated directly into the agent context.
- Sanitization: The reference code lacks demonstrated sanitization or validation for string metadata returned from the external API, which could contain malicious instructions if a resource name is controlled by a malicious actor.
Audit Metadata