mcp-patterns
Pass
Audited by Gen Agent Trust Hub on Sep 16, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill focuses on security education and defensive patterns, explicitly warning against insecure practices such as returning secrets in tool outputs, using deprecated transports, or performing SQL injection.
- [INDIRECT_PROMPT_INJECTION]: The skill identifies MCP tool metadata as a vulnerability surface and provides mandatory sanitization guidelines, including regex-based redaction of injection patterns and normalization of obfuscated encodings (HTML, URL, Hex, and Homoglyphs) to mitigate risks associated with untrusted tool descriptions.
- [EXTERNAL_DOWNLOADS]: All external resource references target official Model Context Protocol repositories, well-known package registries, or established ecosystem directories. The skill recommends version pinning and provides a vetting checklist for third-party servers to prevent supply-chain attacks.
- [CREDENTIALS_UNSAFE]: The skill provides secure examples for handling secrets via environment variables and OAuth PKCE, while explicitly marking hardcoded tokens or sensitive session IDs as incorrect patterns.
Audit Metadata