mcp-builder
Pass
Audited by Gen Agent Trust Hub on May 6, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The evaluation script
scripts/evaluation.pyand connection utilityscripts/connections.pyinclude functionality to launch local MCP servers using standard input/output (stdio). This involves executing shell commands and managing subprocesses, which is the primary intended purpose of the evaluation harness. - [EXTERNAL_DOWNLOADS]: The skill fetches official documentation and SDK information from
modelcontextprotocol.ioand themodelcontextprotocolorganization's GitHub repositories. These are well-known, trusted sources for the protocol being implemented. - [DATA_EXFILTRATION]: The evaluation harness (
scripts/evaluation.py) communicates with the Anthropic API to process tasks. It requires an API key, which is managed via environment variables according to standard security practices. - [PROMPT_INJECTION]: The skill processes task questions from user-provided XML files. While this creates a surface for indirect prompt injection if the evaluation questions are sourced from an untrusted third party, it is an inherent and expected feature of an evaluation tool.
Audit Metadata