build-mcp-use-client

Pass

Audited by Gen Agent Trust Hub on Oct 9, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The diagnostic script scripts/check-mcp-use-version.sh performs a network request using npm view to fetch metadata from the npm registry. This is used solely for verifying version compatibility and project baseline.\n- [COMMAND_EXECUTION]: The skill includes shell scripts (scripts/check-mcp-use-version.sh, scripts/diagnose-client.sh) that use standard system commands like find, grep, node, and npm to analyze the local project structure and environment. These operations are diagnostic in nature and do not execute untrusted external code.\n- [INDIRECT_PROMPT_INJECTION]: The skill facilitates the creation of MCP clients which inherently process data from external servers. This ingestion surface is documented with specific security guidance in references/patterns/anti-patterns.md, recommending sanitization of server content (e.g., using DOMPurify) and validation of tool results.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 9, 2026, 10:27 PM