mcp-quickstart-scaffolder
Warn
Audited by Gen Agent Trust Hub on Sep 16, 2026
Risk Level: MEDIUMEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTIONMETADATA_POISONING
Full Analysis
- [REMOTE_CODE_EXECUTION]: The skill instructs the agent to run code from the NPM registry via
npm create mcp-quickstart@latestandnpx mcp-quickstart. These packages are not associated with a verified or trusted vendor, allowing for potential execution of unvetted code. - [EXTERNAL_DOWNLOADS]: The documentation points to a third-party GitHub repository (
G12789/mcp-quickstart) for templates and custom development. This repository is not part of the authorized vendor's infrastructure. - [METADATA_POISONING]: The skill manifest contains conflicting authorship information, claiming to be by 'ara.so' and referencing external GitHub accounts, while being officially attributed to 'reason-machines'. This discrepancy is deceptive and could lead to misjudgment of the skill's origin and safety.
- [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from OpenAPI URLs and curl command strings to generate executable server logic.
- Ingestion points: OpenAPI specs (URLs/files) and curl command strings.
- Boundary markers: Absent.
- Capability inventory: Generated code performs network operations (
fetch) and accesses environment variables. - Sanitization: No evidence of sanitization for the inputs used in code generation.
- [DYNAMIC_EXECUTION]: The core functionality involves generating and executing new scripts at runtime, which is inherently risky when combined with unverified templates.
- [COMMAND_EXECUTION]: The skill performs shell-level operations including package installation, service authentication (
wrangler login), and deployment.
Audit Metadata