mcpb
Pass
Audited by Gen Agent Trust Hub on Jun 22, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill uses official templates from the author's organization to scaffold new projects via the GitHub CLI. These templates are appropriate for the skill's stated purpose of building MCP servers.
- [SAFE]: Secret management follows industry best practices. The skill guides users to store API keys in environment variables and .env files, which are explicitly included in .gitignore templates to prevent accidental exposure.
- [SAFE]: Command execution is limited to standard development tasks such as dependency management, linting, testing, and releasing using well-known tools like uv, npm, ruff, and the GitHub CLI.
- [SAFE]: External dependencies are restricted to well-known development tools and official packages like the Model Context Protocol SDK and FastMCP.
- [SAFE]: The skill processes external API documentation to assist in server implementation. While this represents a data ingestion point, it is handled within the context of a developer workflow and is necessary for the skill's core functionality.
Audit Metadata