mcp-builder
Pass
Audited by Gen Agent Trust Hub on May 8, 2026
Risk Level: SAFE
Full Analysis
- [COMMAND_EXECUTION]: The skill includes Python scripts (
scripts/evaluation.pyandscripts/connections.py) that enable running local MCP servers. These scripts use the standardstdiotransport to spawn subprocesses for the server commands, which is the documented and expected method for testing MCP integrations. - [PROMPT_INJECTION]: The evaluation harness reads test questions from user-provided XML files. While this creates a surface for indirect prompt injection if untrusted files are used, it is a standard design pattern for an automated LLM evaluation framework and does not represent a malicious intent in this context.
Audit Metadata