mcp-builder
Pass
Audited by Gen Agent Trust Hub on Aug 26, 2026
Risk Level: SAFECOMMAND_EXECUTIONDATA_EXFILTRATIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill includes scripts (scripts/connections.py and scripts/evaluation.py) designed to launch and interact with MCP servers via standard input/output (stdio). This involves spawning subprocesses using user-provided commands and arguments.\n- [DATA_EXPOSURE_AND_EXFILTRATION]: The evaluation harness (scripts/evaluation.py) transmits task questions and MCP server tool outputs to the Anthropic API for processing. This is the intended behavior for an AI-powered evaluation tool.\n- [EXTERNAL_DOWNLOADS]: The documentation guide (SKILL.md) references external resources, including the MCP protocol specification and SDK documentation hosted on GitHub repositories. These references target the official project repository and well-known services.\n- [INDIRECT_PROMPT_INJECTION]: The skill possesses an indirect injection surface within its evaluation harness.\n
- Ingestion points: Data is ingested from an external XML evaluation file (scripts/evaluation.py) and from the outputs of tools provided by the MCP server under test.\n
- Boundary markers: While the system prompt uses XML-style tags to structure assistant responses, there are no explicit delimiters or protective instructions wrapping the untrusted input (questions and tool results) to prevent them from influencing the agent's behavior.\n
- Capability inventory: The skill can execute arbitrary local commands (via stdio transport) and perform network operations (via SSE/HTTP transports and API calls).\n
- Sanitization: There is no validation or sanitization of the input content before it is interpolated into the message history.
Audit Metadata