Audit History

Version	Date	Result	Review items	Change vs previous
v9 Latest	Jul 23, 2026, 05:01 AM	3 confirmed	2	No capability change
v8	Jul 7, 2026, 08:36 PM	7 confirmed	2	No capability change
v7	Jul 5, 2026, 02:23 AM	2 confirmed	2	Contains scripts
v6	Jun 28, 2026, 10:48 AM	2 confirmed	1	Contains scripts
v5	Jan 16, 2026, 05:35 PM	No confirmed findings	0	No capability change
v4	Jan 16, 2026, 05:35 PM	No confirmed findings	0	Env variables Contains scripts
v3	Jan 10, 2026, 10:35 AM	No confirmed findings	0	No capability change
v2	Jan 10, 2026, 10:35 AM	No confirmed findings	0	No capability change
v1	Jan 10, 2026, 10:35 AM	No confirmed findings	0	Baseline

Jul 23, 2026, 05:01 AM

Most static alerts are false positives from Markdown, template strings, placeholders, or documented API examples. Two exposure patterns and three semantic design risks remain confirmed.

11

Files scanned

3,634

Lines analyzed

8

Review items

0

False positives ignored

Confirmed security concerns (3)

High

references/node_mcp_server.md:717-740 references/taskflow_patterns.md:12-18 references/taskflow_patterns.md:54-68

Unauthenticated Remote MCP Endpoints

Remote examples expose MCP handlers without client authentication. Permissive CORS and broad binding can make upstream capabilities reachable by unauthorized clients.

The examples explicitly omit MCP client authentication, allow every CORS origin, and bind the TaskFlow server to all interfaces.

High

references/taskflow_patterns.md:127-145 scripts/evaluation.py:326-333 references/evaluation.md:438-470

Credentials Exposed as Tool and CLI Inputs

The guidance puts access tokens in model-visible tool parameters and accepts secrets through command arguments. Transcripts, logs, or process listings may expose them.

The documented tool schema includes access_token, while evaluation examples place API keys and authorization headers directly on the command line.

High

scripts/evaluation.py:94-103 scripts/evaluation.py:109-145

Untrusted MCP Content Re-enters Agent Loop

The evaluator sends server-defined tools and tool results directly to the model. A malicious server can inject instructions or influence later tool calls.

Tool schemas and returned content cross directly into model requests without server trust checks, content isolation, or confirmation controls.

Capability review items (2)

These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.

High

references/taskflow_patterns.md:67

Hardcoded IP address

host="0.0.0.0",

The example binds an unauthenticated HTTP service to every interface, making accidental network exposure likely when users copy the pattern.

Medium

SKILL.md:161

Hardcoded IP address

"0.0.0.0:*",

Allowing the all-interface address in Host validation broadens remote reachability and weakens the nearby DNS rebinding guidance.

Risk Factors

🌐 Network access (35)

🔑 Env variables (18)

⚙️ External commands (44)

Audited by: codex

Audit version 8

Jul 7, 2026, 08:36 PM

Most static detections are false positives from Markdown examples, placeholder secrets, and TypeScript template literals. Confirmed risks are concentrated in the evaluation harness, which can launch user-supplied stdio commands and forward secrets, plus documentation that shows broad network exposure settings. No prompt-injection attempt was found in the reviewed files.

11

Files scanned

3,634

Lines analyzed

12

Review items

0

False positives ignored

Confirmed security concerns (7)

High

scripts/connections.py:80

Environment file access

self.env = env

The env object can contain secrets and is stored for a stdio MCP child process. This is intentional harness behavior, but it is security-relevant when the command is untrusted.

High

scripts/connections.py:84

Environment file access

StdioServerParameters(command=self.command, args=self.args, env=self.env)

The env dictionary is passed directly into StdioServerParameters for the launched MCP process. Any supplied secrets are exposed to that child command.

High

scripts/evaluation.py:344

Environment file access

env_vars = parse_env_vars(args.env) if args.env else None

The script parses command-line environment variables that may include API keys and forwards them into the MCP connection. Secrets can leak to shell history or an untrusted server command.

High

scripts/evaluation.py:326-354 scripts/connections.py:76-84

User-Supplied Command Execution in Evaluation Harness

The evaluation CLI accepts a command and arguments, then passes them to the MCP stdio client. A copied or untrusted command could execute local programs during evaluation.

The CLI options define command and args, and the connection class sends them to StdioServerParameters. This is intentional behavior but creates real execution risk if inputs are untrusted.

High

references/evaluation.md:438-446 references/evaluation.md:560-568 scripts/evaluation.py:327-344

Secrets Passed Through Command-Line Evaluation Options

The guide demonstrates passing API keys and GitHub tokens through -e command-line options. This can leak secrets through shell history, process listings, or an untrusted child process.

The documentation shows concrete -e API_KEY and GITHUB_TOKEN examples, and the script parses those values. The tokens are placeholders, but the handling pattern is risky.

High

SKILL.md:149-164 references/taskflow_patterns.md:51-68

Unsafe Remote Transport Exposure Guidance

The documentation includes examples with 0.0.0.0 binding, permissive CORS, and broad host allowances. Copying these settings can expose MCP endpoints beyond the intended host.

The cited examples combine broad network exposure settings with local or internal deployment guidance. This is a real configuration risk even though it is presented as documentation.

Medium

references/python_mcp_server.md:506-517

Interactive API Key Collection Example

The Python guide shows an MCP tool asking the user for an API key through context elicitation. This pattern can normalize credential collection by tools without a stronger trust flow.

The example explicitly requests sensitive information and then uses it in an API call. It is an example, not malicious code, so the confidence is high but not absolute.

Capability review items (2)

These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.

Medium

references/taskflow_patterns.md:67

Hardcoded IP address

host="0.0.0.0",

The server example binds uvicorn to 0.0.0.0, and nearby guidance uses permissive CORS. Copying this pattern can expose an MCP endpoint beyond localhost.

Medium

SKILL.md:161

Hardcoded IP address

"0.0.0.0:*",

The Docker host validation example includes 0.0.0.0:* in allowed_hosts. Copying this setting can weaken transport host validation for local MCP servers.

Risk Factors

🌐 Network access (35)

🔑 Env variables (18)

⚙️ External commands (44)

Audited by: codex

Audit version 7

Jul 5, 2026, 02:23 AM

Most static findings are false positives from Markdown examples, TypeScript template literals, placeholder URLs, and placeholder credential names. Confirmed issues are limited to security-relevant deployment guidance around broad HTTP exposure and the evaluation harness path that can launch user-specified commands. No evidence found of prompt injection text or malicious exfiltration intent.

11

Files scanned

3,634

Lines analyzed

7

Review items

0

False positives ignored

Confirmed security concerns (2)

Medium

scripts/evaluation.py:327-351 scripts/connections.py:76-84

User-Specified Command Execution in Evaluation Harness

The evaluation harness accepts a command and arguments from the user and passes them to the MCP stdio client. This is intended for testing local MCP servers, but it can execute arbitrary local programs if used with untrusted input.

The argparse options collect a user-provided command and arguments, and connections.py passes them into StdioServerParameters. The behavior is legitimate for evaluation but still creates local command execution risk.

Medium

references/taskflow_patterns.md:12-18 references/taskflow_patterns.md:55-60

Permissive Internal HTTP Deployment Pattern

The TaskFlow reference describes an internal MCP server with upstream authentication and shows wildcard CORS settings. If copied outside a controlled internal network, this pattern can expose tools too broadly.

The file explicitly states auth is handled upstream and the shown CORS wrapper allows all origins and headers. The risk depends on deployment context, so confidence is high but not absolute.

Capability review items (2)

These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.

Medium

references/taskflow_patterns.md:67

Hardcoded IP address

host="0.0.0.0",

The reference pattern binds a development server to 0.0.0.0, which can expose the MCP HTTP endpoint beyond localhost if copied into an unsafe environment. This is documentation, but it is security-relevant deployment guidance.

Medium

SKILL.md:161

Hardcoded IP address

"0.0.0.0:*",

The primary skill guidance includes 0.0.0.0:* in allowed_hosts for Docker transport security. This can broaden host acceptance if copied into a public deployment without additional controls.

Risk Factors

🌐 Network access (35)

🔑 Env variables (18)

⚙️ External commands (44)

Audited by: codex

Audit version 6

Jun 28, 2026, 10:48 AM

Static analysis produced many high and critical signals, but most are false positives from Markdown examples and headings. The confirmed risks are expected evaluator capabilities: launching a user-specified local MCP command, connecting to user-specified remote endpoints, and handling user-provided credentials. No evidence found of malicious intent, hidden exfiltration, real hardcoded secrets, weak cryptographic code, or prompt injection attempts.

11

Files scanned

3,634

Lines analyzed

7

Review items

3

False positives ignored

Confirmed security concerns (2)

Medium

scripts/evaluation.py:327-344 scripts/connections.py:76-84

Evaluation Harness Can Launch User-Specified Commands

The evaluation workflow accepts a command, arguments, and environment values for stdio MCP servers, then passes them into MCP stdio connection setup. This is expected for evaluating local servers, but it means the script can execute arbitrary user-selected programs if run with untrusted input.

The command and arguments are user-controlled CLI values that are forwarded to StdioServerParameters. The behavior is legitimate for an evaluator, so the risk is contextual rather than malicious.

Medium

scripts/evaluation.py:331-344 scripts/connections.py:88-109

Evaluation Harness Can Connect to Arbitrary MCP URLs

The evaluation script accepts SSE or HTTP URLs and optional headers, then connects to those endpoints. This is normal for testing remote MCP servers, but users should avoid untrusted endpoints and sensitive headers.

The script directly supports user-provided remote URLs and headers. I found no evidence of hidden exfiltration, but remote connection behavior is real and should be disclosed.

Needs review findings (1)

These findings came from uncertain legacy audit verdicts, so they require review but are not counted as confirmed security issues.

Medium

references/evaluation.md:395-399 references/evaluation.md:438-457 references/taskflow_patterns.md:101-128 references/node_mcp_server.md:704-744 references/python_mcp_server.md:510-517

Documentation Encourages Credential and Token Handling

Reference material contains examples for API keys, bearer tokens, forwarded JWTs, and environment variables. These examples are instructional and use placeholders, but users could copy them with real secrets into files or shell history.

The examples clearly involve credentials, but they are documentation patterns and placeholders rather than hardcoded real secrets. The main risk is unsafe user adaptation.

Static false positives ignored (3)

These static matches were dismissed by semantic review or matched schema-only tokens, so they are shown for transparency but do not drive the quality score.

Low

SKILL.md:112-121 references/evaluation.md:430-447 references/node_mcp_server.md:81-94 references/python_mcp_server.md:248-260

Static Analyzer Flagged Markdown Examples as Executable Shell Patterns

Most external command findings occur in Markdown reference guides and code fences, including install, build, and evaluation commands. They are instructional content rather than code that runs automatically when the skill is loaded.

The flagged lines are Markdown examples or prose, not runtime execution paths. The actual scripts were reviewed separately for real command behavior.

Low

SKILL.md:3-8 references/mcp_best_practices.md:154-159 references/node_mcp_server.md:120-123 references/python_mcp_server.md:37-54

Weak Cryptography Findings Are Documentation False Positives

The reported weak cryptography blocker locations align with Markdown syntax, headings, version strings, examples, and general text rather than cryptographic implementations. No evidence found of MD5, SHA-1, DES, or similar weak algorithms used by executable skill code.

Review of the cited areas found documentation structure and server examples, not cryptographic routines. I did not find executable weak-crypto use in the scripts.

Low

SKILL.md:11-19

No Prompt Injection Attempt Found

Targeted review did not find text that claims to override system instructions, skip security review, or impersonate higher-priority instructions. The skill content stays focused on MCP server development guidance.

A targeted search for common prompt-injection phrases returned no matches. Manual review of the main skill instructions also found no override attempt.

Risk Factors

⚡ Contains scripts (3)

scripts/evaluation.py:305-373 scripts/connections.py:73-151 scripts/verify.py:1-26

⚙️ External commands (3)

scripts/evaluation.py:327-329 scripts/connections.py:76-84 SKILL.md:112-121

🌐 Network access (3)

scripts/evaluation.py:331-333 scripts/connections.py:88-109 references/node_mcp_server.md:727-739

🔑 Env variables (3)

scripts/evaluation.py:329-344 scripts/connections.py:76-84 references/node_mcp_server.md:707-744

Detected Patterns

User-Controlled Local Process Launch for Stdio EvaluationUser-Controlled Remote Endpoint and Headers

Audited by: codex

Audit version 5

Jan 16, 2026, 05:35 PM

This is a documentation/guide skill containing markdown reference files and utility scripts for building MCP servers. All 575 static findings are FALSE POSITIVES - the analyzer misinterprets markdown code examples as executable security issues. The scripts (evaluation.py, connections.py) are legitimate MCP evaluation utilities using standard, documented patterns.

12

Files scanned

3,938

Lines analyzed

3

Review items

0

False positives ignored

Risk Factors

⚙️ External commands (6)

SKILL.md:31-175 references/evaluation.md:19-26 references/mcp_best_practices.md:6-104 references/node_mcp_server.md:12-50 references/python_mcp_server.md:12-72 references/taskflow_patterns.md:11-50

🌐 Network access (3)

SKILL.md:41-61 references/evaluation.md:456-469 references/python_mcp_server.md:43-353

🔑 Env variables (3)

references/evaluation.md:398-444 references/node_mcp_server.md:707-744 references/python_mcp_server.md:511-517

Audited by: claude

Audit version 4

Jan 16, 2026, 05:35 PM

This is a documentation/guide skill containing markdown reference files and utility scripts for building MCP servers. All 575 static findings are FALSE POSITIVES - the analyzer misinterprets markdown code examples as executable security issues. The scripts (evaluation.py, connections.py) are legitimate MCP evaluation utilities using standard, documented patterns.

12

Files scanned

3,938

Lines analyzed

3

Review items

0

False positives ignored

Risk Factors

⚙️ External commands (6)

SKILL.md:31-175 references/evaluation.md:19-26 references/mcp_best_practices.md:6-104 references/node_mcp_server.md:12-50 references/python_mcp_server.md:12-72 references/taskflow_patterns.md:11-50

🌐 Network access (3)

SKILL.md:41-61 references/evaluation.md:456-469 references/python_mcp_server.md:43-353

🔑 Env variables (3)

references/evaluation.md:398-444 references/node_mcp_server.md:707-744 references/python_mcp_server.md:511-517

Audited by: claude

Audit version 3

Jan 10, 2026, 10:35 AM

Documentation and guidance skill with Python evaluation scripts. Network calls are to Anthropic API and configurable MCP servers only. All code serves legitimate testing and documentation purposes with no data exfiltration or suspicious behavior patterns detected.

11

Files scanned

3,052

Lines analyzed

3

Review items

0

False positives ignored

Risk Factors

⚡ Contains scripts (3)

scripts/connections.py:1-151 scripts/evaluation.py:1-373 scripts/verify.py:1-26

🌐 Network access (3)

scripts/evaluation.py:17 scripts/evaluation.py:227-228 scripts/evaluation.py:347-354

⚙️ External commands (1)

scripts/evaluation.py:326-329

Audited by: claude

Audit version 2

Jan 10, 2026, 10:35 AM

Documentation and guidance skill with Python evaluation scripts. Network calls are to Anthropic API and configurable MCP servers only. All code serves legitimate testing and documentation purposes with no data exfiltration or suspicious behavior patterns detected.

11

Files scanned

3,052

Lines analyzed

3

Review items

0

False positives ignored

Risk Factors

⚡ Contains scripts (3)

scripts/connections.py:1-151 scripts/evaluation.py:1-373 scripts/verify.py:1-26

🌐 Network access (3)

scripts/evaluation.py:17 scripts/evaluation.py:227-228 scripts/evaluation.py:347-354

⚙️ External commands (1)

scripts/evaluation.py:326-329

Audited by: claude

Audit version 1

Jan 10, 2026, 10:35 AM

Documentation and guidance skill with Python evaluation scripts. Network calls are to Anthropic API and configurable MCP servers only. All code serves legitimate testing and documentation purposes with no data exfiltration or suspicious behavior patterns detected.

11

Files scanned

3,052

Lines analyzed

3

Review items

0

False positives ignored

Risk Factors

⚡ Contains scripts (3)

scripts/connections.py:1-151 scripts/evaluation.py:1-373 scripts/verify.py:1-26

🌐 Network access (3)

scripts/evaluation.py:17 scripts/evaluation.py:227-228 scripts/evaluation.py:347-354

⚙️ External commands (1)

scripts/evaluation.py:326-329

Audited by: claude

Version comparison

Confirmed security concerns (3)

Risk Factors

Confirmed security concerns (7)

Risk Factors

Confirmed security concerns (2)

Risk Factors

Confirmed security concerns (2)

Risk Factors

Detected Patterns

Risk Factors

Risk Factors

Risk Factors

Risk Factors

Risk Factors