mcp-server-builder
Pass
Audited by Gen Agent Trust Hub on Sep 20, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill instructs the user to download official packages from NPM (@modelcontextprotocol/sdk, zod, typescript) and PyPI (mcp[cli], httpx). These are well-known and official libraries for MCP development.
- [COMMAND_EXECUTION]: The skill provides standard command-line instructions for initializing projects and running development servers (npm install, pip install, node, python).
- [INDIRECT_PROMPT_INJECTION]: The generated server templates process data from external sources like the GitHub API and PostgreSQL databases. The skill mitigates this surface by instructing the use of Zod for schema validation and regular expressions to enforce read-only database queries. Ingestion points: src/index.ts, server.py. Boundary markers: Zod schemas. Capability inventory: network access (GitHub), database access (Postgres). Sanitization: Zod validation and SELECT-only regex.
Audit Metadata