mcp-builder
Pass
Audited by Gen Agent Trust Hub on Oct 15, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill uses a local script (
~/.claude/scripts/token-budget.mjs) via Node.js to enforce context size limits during development. This is a standard operational utility in the target environment.\n- [INDIRECT_PROMPT_INJECTION]: The skill facilitates the creation of tool surfaces that ingest untrusted data, constituting an indirect prompt injection attack surface.\n - Ingestion points: Untrusted data enters the agent context through tool parameters defined in the implementation phase (e.g., product SKUs, customer IDs, and search parameters).\n
- Boundary markers: Risk is managed through the requirement of descriptive tool documentation, strict JSON Schema definitions for every parameter, and the use of protocol-level hints (
destructiveHint,readOnlyHint) to regulate agent autonomy.\n - Capability inventory: The skill enables building tools with access to internal APIs, databases, and side-effecting workflows (e.g., placing orders or sending communications).\n
- Sanitization: The instructions explicitly mandate input validation using libraries like Zod or Pydantic, output sanitization of sensitive PII/secrets, and strict avoidance of unsafe string concatenation in shell, SQL, or file system operations.
Audit Metadata