mcp-server-offering
Pass
Audited by Gen Agent Trust Hub on Oct 26, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill is primarily instructional and does not include executable code, scripts, or tool definitions. Its primary function is to guide an AI agent in designing a product surface for a SaaS vendor.
- [SAFE]: The skill actively promotes security best practices. It includes a 'Failure modes' checklist that warns against common vulnerabilities like the 'confused-deputy' problem (forwarding bearer tokens), client-side only security controls, and unverified lockdown modes.
- [SAFE]: The skill includes an 'Evidence hygiene' rule that instructs the agent to reject and debunk widely circulated but unverifiable or false statistics regarding MCP adoption and security (e.g., debunking claims that 78% of enterprises use MCP in production).
- [SAFE]: References to external resources (such as
modelcontextprotocol/ext-appsandsamber/developer-platform-skills) point to well-known organizations or the skill author's own verified infrastructure. All mentioned commands (e.g.,npx create-mcp-app) are standard developer tools. - [SAFE]: The 'Memory' feature suggests using a local file (
developer-platform-context.md) to maintain state across sessions, which is a standard pattern for long-context agent workflows and does not involve unauthorized data access or exfiltration.
Audit Metadata