{"data":{"skill":{"slug":"zhanlincui-mcp-builder","name":"mcp-builder","icon":"📦","repo":"https://github.com/ZhanlinCui/Ultimate-Agent-Skills-Collection/tree/main/mcp-builder","status":"approved","author":"ZhanlinCui","authorVersion":null,"skillstoreRevision":null},"audit":{"id":"0e099171-7e66-48d8-87a2-9c64aac72ab1","skill_id":"3f89c9f1-7828-47d4-a846-438599d30c2e","version":1,"content_hash":"1c771d39ea337899f0e2ffb6fa8a5c26","risk_level":"low","is_blocked":false,"safe_to_publish":true,"analysis_status":"ok","agent_auto_install_policy":null,"manual_install_policy":null,"summary":"This is a documentation skill containing guides for building MCP servers. Static analysis detected 498 patterns, but nearly all are FALSE POSITIVES from markdown documentation files showing code examples. The Python scripts (evaluation.py, connections.py) are legitimate evaluation tooling using official Anthropic and MCP SDKs. Minor risk from environment variable handling in evaluation scripts.","remediation":[],"risk_factor_evidence":[{"factor":"external_commands","evidence":[{"file":"reference/evaluation.md","line_end":26,"line_start":19},{"file":"reference/node_mcp_server.md","line_end":18,"line_start":12},{"file":"reference/python_mcp_server.md","line_end":18,"line_start":12}]},{"factor":"network","evidence":[{"file":"reference/node_mcp_server.md","line_end":413,"line_start":413},{"file":"reference/python_mcp_server.md","line_end":193,"line_start":193},{"file":"scripts/evaluation.py","line_end":318,"line_start":315}]},{"factor":"env_access","evidence":[{"file":"reference/node_mcp_server.md","line_end":707,"line_start":707},{"file":"reference/python_mcp_server.md","line_end":517,"line_start":511},{"file":"scripts/evaluation.py","line_end":344,"line_start":344}]}],"critical_findings":[],"high_findings":[],"medium_findings":[{"title":"Environment Variable Handling in Evaluation Scripts","locations":[{"file":"scripts/evaluation.py","line_end":344,"line_start":329}],"confidence":0.65,"description":"The evaluation.py script accepts environment variables via command-line arguments which could potentially expose secrets if logged. Variables are parsed but not validated for sensitive patterns.","confidence_reasoning":"Environment variables passed via CLI can appear in process listings and logs. The script parses them without filtering sensitive patterns like API keys or tokens."}],"low_findings":[{"title":"Hardcoded URLs in Documentation","locations":[{"file":"SKILL.md","line_end":65,"line_start":41},{"file":"reference/python_mcp_server.md","line_end":43,"line_start":43}],"confidence":0.95,"description":"Documentation files contain hardcoded URLs for MCP SDK repositories and documentation sites. These are informational references, not security risks.","confidence_reasoning":"URLs point to official MCP SDK GitHub repositories and documentation sites - these are legitimate documentation references."},{"title":"HTTP Client Library Usage in Examples","locations":[{"file":"reference/node_mcp_server.md","line_end":413,"line_start":413},{"file":"reference/python_mcp_server.md","line_end":193,"line_start":193}],"confidence":0.9,"description":"Documentation contains examples using HTTP client libraries for API calls. These are instructional code examples, not executable code in the skill itself.","confidence_reasoning":"HTTP client usage is in markdown documentation showing example MCP server implementations, not in the skill's executable code."}],"dangerous_patterns":[],"files_scanned":9,"total_lines":3330,"audit_model":"claude","audited_at":"2026-02-24T09:22:59.73+00:00","created_at":"2026-02-24T15:49:01.065211+00:00","static_findings":[],"finding_verdicts":[],"semantic_findings":[],"subject_marketplace_commit_sha":null,"subject_content_hash":null,"subject_tree_hash":null,"subject_plugin_path":null,"audit_payload_hash":null,"confirmed_risk_level":null,"scanner_version":null,"policy_version":null,"subject":{"marketplaceCommitSha":null,"contentHash":null,"treeHash":null,"pluginPath":null,"auditPayloadHash":null},"scannerVersion":null,"policyVersion":null},"auditTranslation":null,"localization":{"requestedLocale":"en","contentLocale":"en","availableLocales":["en"],"fallbackToEnglish":false},"attestation":{"availability":"not_attestable","url":null,"status":null,"reason":"canonical install advisories are incomplete"},"trust":{"publicState":"public","auditState":"complete","auditCurrentness":null,"confirmedRiskLevel":"safe","confirmedFindingCount":0,"capabilityReviewCount":2,"needsReviewCount":0,"falsePositiveCount":1,"agentAutoInstallPolicy":null,"manualInstallPolicy":null,"artifactSignatureState":"available","attestationState":"not_attestable","verificationState":"not_verified"},"isLatest":false}}