{"data":{"skill":{"slug":"mcp-use-mcp-builder","name":"mcp-builder","icon":"📦","repo":"https://github.com/mcp-use/mcp-use/tree/main/skills/mcp-builder/","status":"approved","author":"mcp-use","authorVersion":null,"skillstoreRevision":null},"audit":{"id":"00ee3c8d-1c64-43d9-a340-ce6f2782147d","skill_id":"fc219f52-e999-4a9b-b3f8-89d4d6ff3dee","version":1,"content_hash":"96db24b9584965643ba7c0854025fcf0","risk_level":"low","is_blocked":false,"safe_to_publish":true,"analysis_status":"ok","agent_auto_install_policy":null,"manual_install_policy":null,"summary":"All 442 static findings are false positives. The skill is a legitimate MCP server builder framework (deprecated). Findings appear in documentation/reference files showing code examples. The 'weak crypto' alerts are triggered by `.describe()` method (Zod), 'external commands' by markdown code fences, 'env access' by example config patterns, and 'network' by API call examples. No malicious code detected.","remediation":[],"risk_factor_evidence":[{"factor":"external_commands","evidence":[{"file":"evals/README.md","line_end":16,"line_start":9},{"file":"SKILL.md","line_end":62,"line_start":33},{"file":"references/design-and-architecture.md","line_end":177,"line_start":7},{"file":"references/resource-templates.md","line_end":139,"line_start":7},{"file":"references/response-helpers.md","line_end":296,"line_start":5},{"file":"references/tools-and-resources.md","line_end":314,"line_start":3},{"file":"references/widgets.md","line_end":449,"line_start":7}]}],"critical_findings":[],"high_findings":[],"medium_findings":[],"low_findings":[{"title":"Documentation Examples with Environment Variables","locations":[{"file":"references/tools-and-resources.md","line_end":18,"line_start":18},{"file":"references/tools-and-resources.md","line_end":275,"line_start":275},{"file":"references/tools-and-resources.md","line_end":312,"line_start":312},{"file":"references/widgets.md","line_end":86,"line_start":86},{"file":"references/widgets.md","line_end":359,"line_start":359}],"confidence":0.15,"description":"Reference files contain example code showing environment variable access patterns (process.env). These are educational examples teaching proper configuration, not actual credential access.","confidence_reasoning":"Pattern matched in documentation examples showing proper config patterns - no actual credential exfiltration"},{"title":"Documentation Examples with Network Requests","locations":[{"file":"references/tools-and-resources.md","line_end":283,"line_start":283}],"confidence":0.15,"description":"Reference files contain example code showing fetch() calls to external APIs. These are educational examples demonstrating API integration patterns.","confidence_reasoning":"Educational example showing how to make API calls - not actual credential exfiltration"},{"title":"Markdown Code Block Triggers Command Detection","locations":[{"file":"evals/README.md","line_end":16,"line_start":9},{"file":"SKILL.md","line_end":62,"line_start":33},{"file":"references/design-and-architecture.md","line_end":177,"line_start":7}],"confidence":0.1,"description":"Documentation files use backtick code fences which trigger static scanner 'external commands' detection. These are markdown documentation, not executable code.","confidence_reasoning":"Markdown documentation with code examples - no actual shell command execution"},{"title":"Zod describe() Method Triggers Crypto Alert","locations":[{"file":"SKILL.md","line_end":41,"line_start":41},{"file":"evals/implementation.json","line_end":4,"line_start":4},{"file":"references/tools-and-resources.md","line_end":28,"line_start":24}],"confidence":0.05,"description":"Code examples using Zod schema .describe() method trigger 'weak cryptographic algorithm' alerts (scanner matches 'des'). These are schema field descriptions, not crypto operations.","confidence_reasoning":"Zod schema .describe() method for field documentation - false positive from pattern matching"}],"dangerous_patterns":[],"files_scanned":12,"total_lines":1666,"audit_model":"claude","audited_at":"2026-02-22T08:40:55.116+00:00","created_at":"2026-02-22T09:30:17.735707+00:00","static_findings":[],"finding_verdicts":[],"semantic_findings":[],"subject_marketplace_commit_sha":null,"subject_content_hash":null,"subject_tree_hash":null,"subject_plugin_path":null,"audit_payload_hash":null,"confirmed_risk_level":null,"scanner_version":null,"policy_version":null,"subject":{"marketplaceCommitSha":null,"contentHash":null,"treeHash":null,"pluginPath":null,"auditPayloadHash":null},"scannerVersion":null,"policyVersion":null},"auditTranslation":null,"localization":{"requestedLocale":"en","contentLocale":"en","availableLocales":["en"],"fallbackToEnglish":false},"attestation":{"availability":"not_attestable","url":null,"status":null,"reason":"canonical install advisories are incomplete"},"trust":{"publicState":"public","auditState":"complete","auditCurrentness":null,"confirmedRiskLevel":"safe","confirmedFindingCount":0,"capabilityReviewCount":4,"needsReviewCount":0,"falsePositiveCount":0,"agentAutoInstallPolicy":null,"manualInstallPolicy":null,"artifactSignatureState":"available","attestationState":"not_attestable","verificationState":"not_verified"},"isLatest":false}}