codehealth-mcp
Pass
Audited by Gen Agent Trust Hub on Oct 5, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADS
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill instructs the agent to run the
@codescene/codehealth-mcppackage usingnpx. This fetches and executes the MCP server from the public NPM registry. - [CREDENTIALS_UNSAFE]: The documentation references the
CS_ACCESS_TOKENenvironment variable required for the CodeScene API. It correctly uses the placeholderYOUR_CS_ACCESS_TOKEN_HEREand explicitly warns the user to never commit tokens to the repository. - [INDIRECT_PROMPT_INJECTION]: The skill facilitates the structural analysis of local source code. While source code is untrusted data that could contain prompt injection, the risk is minimal as the tools are designed for design-level health scores rather than natural language interpretation of comments.
Audit Metadata