skills/huangzida/skills/mcp-builder/Gen Agent Trust Hub

mcp-builder

Pass

Audited by Gen Agent Trust Hub on Oct 6, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The scripts/evaluation.py and scripts/connections.py files provide a harness for launching local processes (MCP servers) via subprocess. This is an intended feature that allows developers to test their own code in a local environment.
  • [EXTERNAL_DOWNLOADS]: The documentation provides instructions for the agent to fetch the Model Context Protocol specification and SDK documentation from the official modelcontextprotocol GitHub organization, which is a trusted source for this technology.
  • [INDIRECT_PROMPT_INJECTION]: The evaluation script in scripts/evaluation.py ingests data from external MCP tool outputs and XML-formatted questions. This creates a potential surface for indirect prompt injection if a tested server returns malicious instructions; however, this is a standard risk for a protocol testing harness and is handled by the sub-agent's prompt constraints.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 6, 2026, 04:20 PM