agent-ready-mcp
Pass
Audited by Gen Agent Trust Hub on Aug 22, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill instructs the user to install the
agent-ready-mcppackage from npm, which is the official registry for Node.js packages. It also references the official Agent Ready website (agent-ready.dev) and its GitHub repository for source code and documentation. These are well-known and appropriate sources for the skill's stated purpose. - [COMMAND_EXECUTION]: The skill provides instructions for adding the MCP server to various clients using
npx, which is a standard method for running Node.js CLI tools. The commands are transparent and match the documentation provided by major AI agent platforms (like Claude Desktop or Claude Code). - [PROMPT_INJECTION]: The skill includes a specific 'Security & trust' section that correctly identifies the risk of indirect prompt injection. It warns that data returned from scanned websites should be treated as untrusted data to be summarized, rather than instructions to be followed. This demonstrates proactive security awareness.
- [CREDENTIALS_SAFE]: The skill explicitly instructs the agent to never emit real API keys in its output and provides placeholders (
ar_live_...) for configuration examples. It emphasizes that keys should be handled by the user in their own configuration files or environment variables, following best practices for secret management.
Audit Metadata