mcp-builder
Pass
Audited by Gen Agent Trust Hub on Sep 18, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The
scripts/evaluation.pyscript andscripts/connections.pymodule enable the execution of local commands to run MCP servers via the stdio transport. This is a functional requirement for local development and testing, triggered by user-provided CLI arguments. - [INDIRECT_PROMPT_INJECTION]: The evaluation script processes XML files containing natural language questions which are passed to an AI agent. This constitutes an ingestion point for untrusted data, although it is constrained to the testing context and the primary purpose of tool evaluation.
- [EXTERNAL_DOWNLOADS]: The skill instructions direct the agent to fetch documentation from modelcontextprotocol.io and official SDK repositories to guide the implementation process.
Audit Metadata