install-mcp
Pass
Audited by Gen Agent Trust Hub on Jun 29, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill facilitates the download of third-party software from public repositories (GitHub) and package registries (npm, PyPI) as part of the MCP server installation process.
- [COMMAND_EXECUTION]: The skill executes system commands to configure various CLI tools (Claude, Codex, Gemini, Zencoder), manage file permissions via
chmod, and run the installation processes. It also uses a bash wrapper script (run-mcp-template.sh) to launch MCP servers with appropriate environment variables. - [DATA_EXFILTRATION]: No evidence of data exfiltration was found. The skill actively promotes secure handling of sensitive data by isolating credentials into dedicated, restricted-access environment files (
chmod 600) instead of storing them in global configuration files. - [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted metadata and repository content from external sources. It mitigates the risk of indirect prompt injection by enforcing a security assessment gate (referencing the
oss-security-checkskill) and requiring explicit user review of the server's tool inventory and permission scope before installation.
Audit Metadata