mcp-server-architect
Pass
Audited by Gen Agent Trust Hub on Oct 9, 2026
Risk Level: SAFEREMOTE_CODE_EXECUTIONINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [REMOTE_CODE_EXECUTION]: The skill recommends using
npxcommands to download and execute bootstrap scripts directly from a GitHub repository for environment setup and configuration generation. - Evidence:
npx --yes github:sandraschi/advanced-memory-mcp/scripts/bootstrap/windowsinmodules/ai-ide-development.mdand similar commands for macOS and Linux inmodules/distribution-and-installation.md. - Note: These are vendor resources originating from the skill author's repository.
- [INDIRECT_PROMPT_INJECTION]: The skill provides patterns for building tools that ingest untrusted data from external sources and perform sensitive operations, creating an indirect injection surface.
- Ingestion points:
comprehensive_researchtool inmodules/core-guidance.mdfetches data from web, academic, and news sources;collect_datainmodules/core-guidance.md. - Boundary markers: The guide emphasizes structured JSON responses but does not explicitly require delimiters (like triple backticks or XML tags) for external content interpolation in the agent prompt.
- Capability inventory: The guide includes implementations for network requests (
aiohttp), file system operations (aiofiles), and mentions shell command execution inmodules/architecture-and-standards.md. - Sanitization: The skill strongly recommends Pydantic for input validation and
shlex.quotefor shell command sanitization. - [EXTERNAL_DOWNLOADS]: The documentation references and recommends downloading resources from several external domains and repositories.
- Fetches documentation and release notes from
github.com/anthropics/anthropic-sdkandgithub.com/modelcontextprotocol/specification. - References MCP marketplaces and registries including
glama.ai,lobehub.com,skillsmp.com, andmcp.cool. - [COMMAND_EXECUTION]: The skill provides instructions for executing shell commands for project initialization, linting, and testing.
- Evidence: Commands such as
pip install,mcpb init,uv sync, anduv run ruff checkare scattered throughout the guide.
Audit Metadata