Skills
Navigate
skills/mjunaidca/code-execution-mcp-agent-skills/mcp-client/Gen Agent Trust Hub

mcp-client

Warn

Audited by Gen Agent Trust Hub on Jun 23, 2026

Risk Level: MEDIUMCOMMAND_EXECUTIONREMOTE_CODE_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [COMMAND_EXECUTION]: The script scripts/mcp-client.py uses subprocess.Popen with shell=True to run local MCP servers. The command to be executed is passed directly from the --stdio command-line argument without sanitization.
  • File: scripts/mcp-client.py (line 175)
  • [REMOTE_CODE_EXECUTION]: Documentation and examples in the skill encourage running npx commands to download and execute MCP servers from the NPM registry at runtime.
  • File: SKILL.md (lines 31, 51, 63)
  • [EXTERNAL_DOWNLOADS]: The HTTPTransport class performs POST requests to any URL provided via the --url argument, enabling communication with arbitrary external endpoints.
  • File: scripts/mcp-client.py (line 137)
Audit Metadata
Risk Level
MEDIUM
Analyzed
Jun 23, 2026, 10:25 PM
Security Audit — agent-trust-hub — mcp-client