using-mcp-engineering
Pass
Audited by Gen Agent Trust Hub on Oct 9, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill is composed entirely of educational and instructional Markdown files designed to guide an agent in engineering tasks related to the Model Context Protocol (MCP).
- [PROMPT_INJECTION]: While
authentication-and-trust.mdcontains examples of prompt injection strings (e.g., 'ignore previous instructions'), these are explicitly used within a defensive context to teach the agent how to audit for such vulnerabilities. They are not instructions meant for the agent's own execution. - [CREDENTIALS_UNSAFE]: No hardcoded secrets, API keys, or private keys were detected. The documentation correctly identifies the storage of secrets in environment variables as a best practice and warns against exposing credentials in model-readable resources.
- [COMMAND_EXECUTION]: The skill contains code snippets in Python and TypeScript within the documentation files to illustrate implementation patterns. These snippets are benign examples and do not execute unauthorized or dangerous commands.
- [DATA_EXFILTRATION]: No network exfiltration or sensitive data harvesting patterns were identified. The guidelines emphasize strict audience validation and the use of scoped capability tokens to prevent data exposure.
- [OBFUSCATION]: The analysis did not detect any Base64-encoded instructions, hidden Unicode tags, zero-width characters, or homoglyph-based URL obfuscation.
Audit Metadata