mcp-builder
Pass
Audited by Gen Agent Trust Hub on Jul 16, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The provided evaluation scripts, specifically
scripts/evaluation.pyandscripts/connections.py, use Python's asynchronous subprocess execution to launch MCP servers locally. This is a functional component of the testing harness designed to communicate with servers via standard I/O (stdio).\n- [EXTERNAL_DOWNLOADS]: TheSKILL.mdfile contains instructions for fetching protocol specifications and SDK documentation from official domains, includingmodelcontextprotocol.ioand themodelcontextprotocolGitHub organization. These are well-known, trusted sources for the protocol being taught.\n- [PROMPT_INJECTION]: The evaluation harness inscripts/evaluation.pyincludes a workflow where results from third-party MCP tools are processed and fed back into the agent's context, creating an indirect prompt injection surface.\n - Ingestion points: Data enters the system context through the
connection.call_tool()method inscripts/evaluation.py.\n - Boundary markers: The harness uses structural XML tags in the system prompt but does not implement specific delimiters or 'ignore' instructions for the tool-provided content.\n
- Capability inventory: The evaluation agent has access to all tools exposed by the MCP server, and the harness executes local commands as defined by user CLI input.\n
- Sanitization: Tool outputs are handled as raw strings or JSON without explicit filtering for embedded instructions before being included in the prompt.
Audit Metadata