mcp-builder

Pass

Audited by Gen Agent Trust Hub on Oct 16, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill instructs the user to fetch protocol specifications and SDK documentation from official sources, including modelcontextprotocol.io and the official MCP GitHub repositories. These are well-known and reputable sources for the technology being documented.- [COMMAND_EXECUTION]: The included evaluation harness (scripts/evaluation.py) utilizes the MCP SDK to launch local server processes via standard I/O (stdio). This involves executing commands and arguments provided by the user via command-line flags to facilitate testing of the server under development.- [INDIRECT_PROMPT_INJECTION]: The evaluation script processes XML files containing test questions which are then fed directly into the AI agent's prompt context. While this represents a surface for instruction injection from the data source, it is the standard and intended functionality of the test runner which operates on user-supplied test cases.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 16, 2026, 05:56 AM