mcp-server-catalog-reference
Pass
Audited by Gen Agent Trust Hub on Sep 16, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONCOMMAND_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill recommends the installation of various MCP servers from the NPM registry. Many of these packages are official components within the
@modelcontextprotocolscope, representing the official ecosystem. It also references external transport URLs for hosted services (e.g., hosted on Glitch or vendor domains like ara.so). - [REMOTE_CODE_EXECUTION]: Provides instructions to download and execute remote code using the
npxutility. To mitigate risks, the skill includes explicit guidance on pinning package versions and treating all third-party servers as untrusted code until verified. - [COMMAND_EXECUTION]: Includes shell commands for the
claudeCLI to add servers and modify local configuration files (e.g.,claude_desktop_config.json,settings.json). These commands are standard for managing AI agent capabilities. - [DATA_EXFILTRATION]: Addresses the management of sensitive credentials such as database connection strings and API keys. The skill promotes security best practices by instructing the agent to use environment variables, read-only replicas, and sandbox modes for financial and infrastructure tools.
Audit Metadata