{"data":{"skill":{"slug":"zhanlincui-mcp-builder","name":"mcp-builder","icon":"📦","repo":"https://github.com/ZhanlinCui/Ultimate-Agent-Skills-Collection/tree/main/mcp-builder","status":"approved","author":"ZhanlinCui","authorVersion":null,"skillstoreRevision":null},"audit":{"id":"8509868a-67f3-43d1-9fcb-ccc52164a2e6","skill_id":"3f89c9f1-7828-47d4-a846-438599d30c2e","version":2,"content_hash":"eb5cfdf23796ae6478019bdc2040a0c8","risk_level":"medium","is_blocked":false,"safe_to_publish":true,"analysis_status":"ok","agent_auto_install_policy":null,"manual_install_policy":null,"summary":"Static analysis produced many severe-looking hits, but review shows most are Markdown examples, MCP terminology, placeholder URLs, and normal SDK guidance. The real risks are contextual: the optional evaluation harness can run user-selected stdio commands, connect to remote MCP endpoints, and pass credentials supplied by the user. No prompt injection, obfuscation, hardcoded live secret, or confirmed malicious intent was found.","remediation":[],"risk_factor_evidence":[{"factor":"scripts","evidence":[{"file":"scripts/evaluation.py","line_end":370,"line_start":305},{"file":"scripts/connections.py","line_end":118,"line_start":13}]},{"factor":"external_commands","evidence":[{"file":"scripts/connections.py","line_end":84,"line_start":76},{"file":"scripts/evaluation.py","line_end":353,"line_start":327},{"file":"reference/mcp_best_practices.md","line_end":139,"line_start":125}]},{"factor":"network","evidence":[{"file":"SKILL.md","line_end":65,"line_start":41},{"file":"scripts/connections.py","line_end":109,"line_start":88},{"file":"reference/python_mcp_server.md","line_end":392,"line_start":381},{"file":"reference/node_mcp_server.md","line_end":601,"line_start":595}]},{"factor":"env_access","evidence":[{"file":"scripts/evaluation.py","line_end":302,"line_start":290},{"file":"scripts/evaluation.py","line_end":353,"line_start":343},{"file":"reference/evaluation.md","line_end":399,"line_start":395},{"file":"reference/evaluation.md","line_end":568,"line_start":553},{"file":"reference/node_mcp_server.md","line_end":744,"line_start":704}]}],"critical_findings":[],"high_findings":[],"medium_findings":[{"title":"User-selected MCP server command execution","verdict":"TRUE_POSITIVE","locations":[{"file":"scripts/connections.py","line_end":84,"line_start":76},{"file":"scripts/evaluation.py","line_end":353,"line_start":327}],"confidence":0.86,"description":"The evaluation harness can start a stdio MCP server from a command and arguments supplied by the user. This is expected for testing local MCP servers, but it can execute untrusted code and pass environment variables to that process.","confidence_reasoning":"The harness explicitly accepts a command, args, and env values for stdio transport and passes them into the MCP stdio connection. The behavior is intentional for an evaluator, so the risk is contextual rather than malicious."},{"title":"User-supplied remote MCP endpoint connections","verdict":"TRUE_POSITIVE","locations":[{"file":"scripts/connections.py","line_end":109,"line_start":91},{"file":"scripts/evaluation.py","line_end":353,"line_start":331},{"file":"scripts/evaluation.py","line_end":318,"line_start":315}],"confidence":0.78,"description":"The evaluation tooling supports SSE and HTTP connections to user-provided URLs with optional headers. This is legitimate MCP test functionality, but users could expose bearer tokens or connect to untrusted endpoints if they supply unsafe values.","confidence_reasoning":"The code clearly creates remote MCP clients from caller-provided URLs and headers. The examples use placeholder endpoints, so there is no evidence of hardcoded exfiltration."}],"low_findings":[{"title":"Credential handling appears in examples and evaluator inputs","verdict":"NEEDS_REVIEW","locations":[{"file":"reference/evaluation.md","line_end":399,"line_start":395},{"file":"reference/evaluation.md","line_end":568,"line_start":553},{"file":"reference/node_mcp_server.md","line_end":744,"line_start":704},{"file":"reference/python_mcp_server.md","line_end":517,"line_start":506}],"confidence":0.66,"description":"The skill documents API keys, tokens, and environment variable use for MCP testing and generated servers. The examples are placeholders and mostly recommend environment variables, but users should avoid passing real secrets to untrusted servers or remote endpoints.","confidence_reasoning":"The references show placeholder API keys and token-passing patterns, not live secrets. The concern remains because the evaluator and generated servers are designed to work with real credentials."},{"title":"Most static analyzer hits are documentation false positives","verdict":"FALSE_POSITIVE","locations":[{"file":"SKILL.md","line_end":74,"line_start":37},{"file":"reference/mcp_best_practices.md","line_end":172,"line_start":152},{"file":"reference/python_mcp_server.md","line_end":119,"line_start":68},{"file":"reference/node_mcp_server.md","line_end":601,"line_start":584}],"confidence":0.91,"description":"The reported Ruby backtick and weak cryptography findings occur in Markdown guides and code examples, not in hidden execution logic. Reviewed content shows MCP implementation guidance, SDK examples, and security best practices rather than malicious obfuscation.","confidence_reasoning":"The reviewed locations are prose and illustrative snippets. I found no evidence of weak cryptographic routines, obfuscation, or Ruby shell backticks being used by the skill runtime."}],"dangerous_patterns":[{"title":"Subprocess-based stdio transport","verdict":"TRUE_POSITIVE","locations":[{"file":"scripts/connections.py","line_end":84,"line_start":76},{"file":"reference/mcp_best_practices.md","line_end":139,"line_start":125}],"confidence":0.84,"description":"The stdio connection path can run a local server command chosen by the user. This is normal for MCP stdio testing, but it should be limited to trusted server code.","confidence_reasoning":"The stdio transport is documented as subprocess-based and implemented with caller-provided command values. This confirms external command execution, but only through explicit evaluator use."},{"title":"Network-capable MCP and API examples","verdict":"TRUE_POSITIVE","locations":[{"file":"SKILL.md","line_end":65,"line_start":41},{"file":"reference/python_mcp_server.md","line_end":392,"line_start":381},{"file":"reference/node_mcp_server.md","line_end":601,"line_start":595}],"confidence":0.74,"description":"The skill teaches streamable HTTP MCP servers and API clients. These examples are appropriate for MCP development, but they expand the security boundary to external services.","confidence_reasoning":"The locations show explicit WebFetch guidance and HTTP client examples. The URLs are official documentation or placeholders, so this is a capability risk, not evidence of exfiltration."}],"files_scanned":9,"total_lines":3330,"audit_model":"codex","audited_at":"2026-07-01T02:46:27.833+00:00","created_at":"2026-07-01T04:01:04.843103+00:00","static_findings":[],"finding_verdicts":[],"semantic_findings":[],"subject_marketplace_commit_sha":null,"subject_content_hash":null,"subject_tree_hash":null,"subject_plugin_path":null,"audit_payload_hash":null,"confirmed_risk_level":null,"scanner_version":null,"policy_version":null,"subject":{"marketplaceCommitSha":null,"contentHash":null,"treeHash":null,"pluginPath":null,"auditPayloadHash":null},"scannerVersion":null,"policyVersion":null},"auditTranslation":null,"localization":{"requestedLocale":"en","contentLocale":"en","availableLocales":["en"],"fallbackToEnglish":false},"attestation":{"availability":"not_attestable","url":null,"status":null,"reason":"canonical install advisories are incomplete"},"trust":{"publicState":"public","auditState":"complete","auditCurrentness":null,"confirmedRiskLevel":"medium","confirmedFindingCount":2,"capabilityReviewCount":0,"needsReviewCount":1,"falsePositiveCount":1,"agentAutoInstallPolicy":null,"manualInstallPolicy":null,"artifactSignatureState":"available","attestationState":"not_attestable","verificationState":"not_verified"},"isLatest":false}}