skills/vercel-labs/ai-python/ai/Gen Agent Trust Hub

ai

Pass

Audited by Gen Agent Trust Hub on Jun 15, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
  • [Command Execution]: The documentation describes the use of ai.mcp.get_stdio_tools to run local commands like npx. This is an intended feature for integrating Model Context Protocol (MCP) servers, allowing agents to perform tasks such as file system interaction.
  • [External Resource Management]: Includes instructions for package installation and fetching tools from remote HTTP endpoints, which are routine procedures for the SDK's setup and operation.
  • [Credential Management]: Guidance is provided for using environment variables to securely manage API keys for AI service providers.
  • [Data Ingestion Surface]: The SDK handles data from user messages and tool results (Ingestion points: ai.user_message and tool results in SKILL.md). It utilizes structured roles and context management (Boundary markers: system, user, assistant roles) to maintain context. Capabilities include subprocess execution and network requests (Capability inventory: get_stdio_tools and API streaming). It uses Pydantic to ensure data conforms to expected schemas (Sanitization: Pydantic validation).
Audit Metadata
Risk Level
SAFE
Analyzed
Jun 15, 2026, 01:47 AM
Security Audit — agent-trust-hub — ai