mcp-builder
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill instructs the agent to fetch documentation and SDKs from official GitHub repositories, such as
github.com/modelcontextprotocol/typescript-sdk. These are well-known, trusted sources for MCP development. - [COMMAND_EXECUTION]: The
scripts/evaluation.pyscript andscripts/connections.pymodule are designed to launch and interact with MCP servers. When using thestdiotransport, the script executes a command-line instruction provided by the user to start the server process. This is the standard method for testing local MCP servers. - [DYNAMIC_EXECUTION]: The evaluation harness implements an autonomous agent loop that dynamically calls tools on the connected MCP server and processes the results to answer test questions. This is the core functional requirement of the evaluation script.
- [INDIRECT_PROMPT_INJECTION]: The
scripts/evaluation.pyscript reads test questions from an external XML file (evaluation.xml). These questions are then included in a prompt for an LLM. This creates a surface for indirect prompt injection if the test file contains malicious instructions. - Ingestion points: The
parse_evaluation_filefunction inscripts/evaluation.pyreads data from a user-specified XML file. - Boundary markers: The script uses specific XML-like tags (
<summary>,<feedback>,<response>) to structure the agent's output, but does not provide explicit boundaries or "ignore" instructions for the input questions. - Capability inventory: The script can execute subprocesses (via
stdiotransport) and perform network operations (connecting to the Anthropic API and remote MCP servers). - Sanitization: There is no sanitization or filtering of the question content before it is processed by the agent loop.
Audit Metadata