webmcp-gen
Pass
Audited by Gen Agent Trust Hub on Jul 19, 2026
Risk Level: SAFE
Full Analysis
- [COMMAND_EXECUTION]: The skill involves generating and executing local TypeScript and JavaScript artifacts to validate WebMCP tool registration. This execution is performed via Node.js scripts and Stagehand, which is the primary intended purpose of the toolset.
- [EXTERNAL_DOWNLOADS]: The skill uses
pnpmto install dependencies, specifically the@browserbasehq/stagehandlibrary. These downloads originate from the skill author's official packages on a well-known registry (NPM). - [SAFE]: The compilation script (
scripts/compile.mjs) implements a safety filter that detects and blocks the use ofeval()ornew Function()in tool implementations, preventing common dynamic execution vulnerabilities. - [SAFE]: The scaffolding script (
scripts/scaffold.mjs) includes regex-based validation for project names to prevent path traversal attacks when creating artifact directories. - [SAFE]: The skill's instructions explicitly guide the agent to avoid including sensitive data such as API keys, bearer tokens, or user credentials in the generated code.
Audit Metadata