mcp-skill-shipping
Pass
Audited by Gen Agent Trust Hub on Aug 28, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill acts as a documentation resource for developer workflows. It does not contain any executable code that runs automatically or performs hidden operations.- [EXTERNAL_DOWNLOADS]: The instructions describe how to download and install development tools and scaffolding from GitHub repositories (e.g., repo-tasks, scaffoldapy) belonging to the author's organization. These references are consistent with the stated purpose of setting up a development environment.- [REMOTE_CODE_EXECUTION]: The skill guides users to install tools using
uv tool installandnpx skills addfrom GitHub sources. While these commands involve remote code installation, they are standard package management practices directed at the author's infrastructure or recognized open-source tools like the Vercel Labs 'skills' CLI.- [COMMAND_EXECUTION]: The skill mentions various shell commands (uv,invoke,claude mcp,ln -s) intended for local project configuration. These commands are descriptive and intended for manual execution by a developer during the setup process.
Audit Metadata