protect-mcp-governance
Pass
Audited by Gen Agent Trust Hub on Oct 29, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill instructs the user to fetch and execute third-party CLI tools from the npm registry using
npx. This includesprotect-mcpand@veritasacta/verify. While these are external dependencies, they are the primary tools described by the skill for its stated purpose of agent governance. - [COMMAND_EXECUTION]: The instructions involve executing local scripts and starting servers (e.g.,
node your-mcp-server.js) via theprotect-mcpwrapper to enforce authorization policies. This is standard operational behavior for a security gateway tool. - [SAFE_PRACTICES]: The skill includes security best practices, such as suggesting the use of pinned package versions, warning about path traversal risks in policy authoring (recommending path canonicalization), and advising a 'shadow mode' observation period before enforcing restrictive policies.
Audit Metadata