mcp-builder
Pass
Audited by Gen Agent Trust Hub on Oct 17, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill documentation directs the agent to fetch documentation and SDK information from the official Model Context Protocol website and GitHub repositories. These are well-known and trusted sources for the Model Context Protocol project.\n- [COMMAND_EXECUTION]: The scripts provided for evaluation (scripts/evaluation.py and scripts/connections.py) allow for the execution of local MCP servers as subprocesses via the stdio transport. This is an intended and essential feature for developers to test their servers in a local environment during the development process.\n- [INDIRECT_PROMPT_INJECTION]: The evaluation harness processes inputs from external MCP server tools, which presents a surface for potential indirect prompt injection if an evaluated server is malicious.\n
- Ingestion points: The scripts read test questions from XML files and ingest content returned by tools of the MCP server being tested.\n
- Boundary markers: The system prompt for the evaluation agent utilizes XML tags like , , and to isolate the model's logic and final answers from the tool-provided data.\n
- Capability inventory: The evaluation script provides the agent with access to any tools defined by the MCP server under test, which can include various system or network interactions.\n
- Sanitization: Tool outputs are incorporated into the prompt context directly; the skill relies on the structural XML delimiters and the model's internal safety guardrails to maintain security during testing sessions.
Audit Metadata