detect-mcps
Pass
Audited by Gen Agent Trust Hub on Apr 29, 2026
Risk Level: SAFE
Full Analysis
- [COMMAND_EXECUTION]: The skill uses the
Bashtool to executeclaude plugin listandclaude mcp list. These commands are used to enumerate installed extensions and servers to determine available system capabilities. This behavior is restricted via theallowed-toolsfrontmatter and is consistent with the skill's stated purpose. - [SAFE]: The skill manages its own state by reading and writing to a local configuration file (
config.json) within the user's data directory. Accessing~/.claude.jsonand.mcp.jsonis performed to discover MCP server metadata, which is standard for platform-integrated tools. - [SAFE]: The skill incorporates a human-in-the-loop verification step (
AskUserQuestion) before finalizing any configuration changes, ensuring the user remains in control of the capability mapping and installation proposals.
Audit Metadata