mcp-builder
Pass
Audited by Gen Agent Trust Hub on Aug 18, 2026
Risk Level: SAFE
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill fetches technical documentation and SDK information from the official Model Context Protocol website and GitHub repositories. These are well-known resources, and their inclusion is documented neutrally as they are essential for the skill's primary purpose.
- [DYNAMIC_EXECUTION]: The evaluation harness (evaluation.py) includes functionality to execute local server commands provided by the user via command-line arguments. This is an intended feature for development testing and requires explicit user input to define the command.
- [DATA_EXPOSURE]: The guides correctly instruct users to store sensitive API keys in environment variables, following industry-standard secure secret management practices.
- [INDIRECT_PROMPT_INJECTION]: The testing system reads external XML files to obtain test questions. While this constitutes a data ingestion surface, the agent loop is constrained by a system prompt that defines its specific role as a tester, and the tool is designed for local development use.
Audit Metadata