The static findings are documentation false positives: placeholder URLs, example API keys, Markdown backticks, and TypeScript template literals. The runnable evaluation harness has two real medium risks: it launches user-selected MCP commands and sends tool outputs to Anthropic. No prompt injection attempt or hardcoded live secret was found.
Evaluation Harness Sends Tool Outputs to Anthropic
The evaluation loop sends user tasks and MCP tool results through Anthropic messages. Sensitive tool outputs could leave the local environment during evaluation.
The code directly calls client.messages.create and appends serialized tool results into follow-up messages. This confirms third-party processing of evaluation data.
The stdio evaluation path accepts a command, arguments, and environment values, then starts the selected MCP server process. This is expected but risky with untrusted input.
The CLI exposes command and args, and MCPConnectionStdio passes them into StdioServerParameters. There is no shell string injection, but it still runs local processes.
The static findings are documentation false positives: placeholder URLs, example API keys, Markdown backticks, and TypeScript template literals. The runnable evaluation harness has two real medium risks: it launches user-selected MCP commands and sends tool outputs to Anthropic. No prompt injection attempt or hardcoded live secret was found.
Evaluation Harness Sends Tool Outputs to Anthropic
The evaluation loop sends user tasks and MCP tool results through Anthropic messages. Sensitive tool outputs could leave the local environment during evaluation.
The code directly calls client.messages.create and appends serialized tool results into follow-up messages. This confirms third-party processing of evaluation data.
The stdio evaluation path accepts a command, arguments, and environment values, then starts the selected MCP server process. This is expected but risky with untrusted input.
The CLI exposes command and args, and MCPConnectionStdio passes them into StdioServerParameters. There is no shell string injection, but it still runs local processes.
Static analysis reported a critical combined pattern and many high findings, but most are false positives from markdown examples, URLs, API key placeholders, and MCP documentation text. The real risk is the included evaluation harness, which can launch user-specified stdio commands, connect to supplied HTTP or SSE endpoints, pass headers and environment variables, call Anthropic, and write reports. No prompt injection attempt or confirmed malicious exfiltration was found, so publication is acceptable with a warning.
Many external command findings come from fenced markdown examples and instructional command snippets. These examples are visible documentation, not code that runs when the skill is loaded.
The cited locations are documentation examples, not executable script entry points. They can lead users to run commands manually, but they are not hidden execution paths.
Capability review items (3)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
The evaluation script accepts a stdio command and arguments, then creates a stdio MCP connection that can run that command. This is expected for an MCP evaluator, but users must treat the target server command as trusted code.
The command and args are explicit CLI inputs that are passed into StdioServerParameters. This confirms executable behavior, but it is core evaluator functionality rather than hidden malicious code.
The evaluation harness accepts user-supplied SSE or HTTP URLs and headers, then connects to those endpoints. This can expose bearer tokens or evaluation traffic to the chosen endpoint if the user supplies an untrusted URL.
The CLI and connection classes clearly support remote URLs and custom headers. The risk depends on user choice of endpoint, so the finding is moderate rather than high.
The documentation and script support API keys, GitHub tokens, authorization headers, and environment variables for evaluation runs. This is legitimate for testing authenticated MCP servers, but secrets can be exposed to local subprocesses or remote endpoints selected by the user.
Secret-related inputs are documented and parsed directly by the harness. I found no hardcoded real secrets or forced exfiltration, so this remains a controlled-use risk.
Static false positives ignored (2)
These static matches were dismissed by semantic review or matched schema-only tokens, so they are shown for transparency but do not drive the quality score.
Weak Cryptography Static Hits Are Documentation False Positives
The high weak cryptography hits appear to be caused by documentation text, markdown syntax, and MCP-related terms rather than implemented cryptographic routines. No evidence found of MD5, SHA-1, or custom weak cryptography used by the executable scripts.
The reported lines are headings or guide text rather than crypto implementations. I found no executable cryptographic use in the scripts during contextual review.
Hardcoded URLs Are Public Documentation References
Hardcoded URLs point to MCP documentation, SDK README files, or placeholder endpoints used in examples. They do not by themselves indicate covert network communication.
The URLs are visible in user-facing instructions and examples. They require user action or user-supplied endpoints, so this is not evidence of concealed callback behavior.
Static analysis reported a critical combined pattern and many high findings, but most are false positives from markdown examples, URLs, API key placeholders, and MCP documentation text. The real risk is the included evaluation harness, which can launch user-specified stdio commands, connect to supplied HTTP or SSE endpoints, pass headers and environment variables, call Anthropic, and write reports. No prompt injection attempt or confirmed malicious exfiltration was found, so publication is acceptable with a warning.
Many external command findings come from fenced markdown examples and instructional command snippets. These examples are visible documentation, not code that runs when the skill is loaded.
The cited locations are documentation examples, not executable script entry points. They can lead users to run commands manually, but they are not hidden execution paths.
Capability review items (3)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
The evaluation script accepts a stdio command and arguments, then creates a stdio MCP connection that can run that command. This is expected for an MCP evaluator, but users must treat the target server command as trusted code.
The command and args are explicit CLI inputs that are passed into StdioServerParameters. This confirms executable behavior, but it is core evaluator functionality rather than hidden malicious code.
The evaluation harness accepts user-supplied SSE or HTTP URLs and headers, then connects to those endpoints. This can expose bearer tokens or evaluation traffic to the chosen endpoint if the user supplies an untrusted URL.
The CLI and connection classes clearly support remote URLs and custom headers. The risk depends on user choice of endpoint, so the finding is moderate rather than high.
The documentation and script support API keys, GitHub tokens, authorization headers, and environment variables for evaluation runs. This is legitimate for testing authenticated MCP servers, but secrets can be exposed to local subprocesses or remote endpoints selected by the user.
Secret-related inputs are documented and parsed directly by the harness. I found no hardcoded real secrets or forced exfiltration, so this remains a controlled-use risk.
Static false positives ignored (2)
These static matches were dismissed by semantic review or matched schema-only tokens, so they are shown for transparency but do not drive the quality score.
Weak Cryptography Static Hits Are Documentation False Positives
The high weak cryptography hits appear to be caused by documentation text, markdown syntax, and MCP-related terms rather than implemented cryptographic routines. No evidence found of MD5, SHA-1, or custom weak cryptography used by the executable scripts.
The reported lines are headings or guide text rather than crypto implementations. I found no executable cryptographic use in the scripts during contextual review.
Hardcoded URLs Are Public Documentation References
Hardcoded URLs point to MCP documentation, SDK README files, or placeholder endpoints used in examples. They do not by themselves indicate covert network communication.
The URLs are visible in user-facing instructions and examples. They require user action or user-supplied endpoints, so this is not evidence of concealed callback behavior.
This skill is a legitimate documentation and evaluation framework for building MCP servers. The 526 static findings are false positives from pattern-matching on documentation examples and license text. The evaluation script launches user-specified MCP servers for testing - a necessary function for its testing purpose. Credentials are passed via command-line and never exfiltrated.
This skill is a legitimate documentation and evaluation framework for building MCP servers. The 526 static findings are false positives from pattern-matching on documentation examples and license text. The evaluation script launches user-specified MCP servers for testing - a necessary function for its testing purpose. Credentials are passed via command-line and never exfiltrated.
This skill provides documentation and evaluation utilities for building MCP servers. The evaluation script can execute subprocess commands to launch MCP servers for testing, which is necessary for its testing purpose. Network calls are limited to user-specified MCP endpoints and the Anthropic API. No sensitive data is accessed or exfiltrated.
This skill provides documentation and evaluation utilities for building MCP servers. The evaluation script can execute subprocess commands to launch MCP servers for testing, which is necessary for its testing purpose. Network calls are limited to user-specified MCP endpoints and the Anthropic API. No sensitive data is accessed or exfiltrated.