apply-clean-mcp-architecture
Pass
Audited by Gen Agent Trust Hub on May 10, 2026
Risk Level: SAFE
Full Analysis
- [PROMPT_INJECTION]: The instructions are purely technical and instructional. There are no attempts to bypass AI safety filters, ignore prior rules, or perform role-play jailbreaks. The skill actually encourages maintaining strict guardrails and adherence to non-negotiable architectural rules.
- [DATA_EXFILTRATION]: No unauthorized network operations or data transmission patterns were found. The skill actively promotes security by instructing developers to create a 'presenters' layer specifically for redacting secrets like DSNs, internal URLs, and provider names before they reach the output wire.
- [CREDENTIALS_UNSAFE]: No hardcoded API keys, tokens, or credentials are present. The skill enforces a 'single config seam' where environment variables are validated using Zod in a dedicated infrastructure file, which is a standard security best practice.
- [COMMAND_EXECUTION]: The skill mentions standard shell commands for code auditing (e.g., find, grep, wc, awk) and development (e.g., pnpm, tsc, eslint). These are used strictly for project structure validation, line counting, and linting during development workflows.
- [EXTERNAL_DOWNLOADS]: The skill references standard repositories and technology vendors (e.g., Redis, S3, Supabase, Vercel) as examples of well-known services. No suspicious or untrusted download sources were detected.
- [REMOTE_CODE_EXECUTION]: No patterns of fetching and executing remote scripts (like curl | bash) were found. The skill focuses on providing a framework for local code generation and refactoring according to specific architectural standards.
Audit Metadata