detect-mcps

Pass

Audited by Gen Agent Trust Hub on Apr 29, 2026

Risk Level: SAFE
Full Analysis
  • [COMMAND_EXECUTION]: The skill uses the Bash tool to execute claude plugin list and claude mcp list. These commands are used to enumerate installed extensions and servers to determine available system capabilities. This behavior is restricted via the allowed-tools frontmatter and is consistent with the skill's stated purpose.
  • [SAFE]: The skill manages its own state by reading and writing to a local configuration file (config.json) within the user's data directory. Accessing ~/.claude.json and .mcp.json is performed to discover MCP server metadata, which is standard for platform-integrated tools.
  • [SAFE]: The skill incorporates a human-in-the-loop verification step (AskUserQuestion) before finalizing any configuration changes, ensuring the user remains in control of the capability mapping and installation proposals.
Audit Metadata
Risk Level
SAFE
Analyzed
Apr 29, 2026, 05:16 AM
Security Audit — agent-trust-hub — detect-mcps