Agentic Mcp Server Builder

• Risk level: Low
• Analyzed: May 1, 2026, 6:07 AM
• Findings: 1
• Version: 0.1.0

Overview

The skill coherently scaffolds MCP server starter files, with the main caveat that its bundled script can write or overwrite local files when run.

This appears safe for its stated purpose. Before installing or using it, review the bundled script, run dry-run mode first, and direct output/scaffold paths to a disposable or dedicated workspace so existing files are not overwritten.

Findings (1)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

ASI02: Tool Misuse and Exploitation

Note

What this means

If the script is run with an existing project path or sensitive output path, it may replace starter files or write artifacts where the user did not intend.

Why it was flagged

The helper intentionally writes an output artifact and, outside dry-run mode, creates scaffold files. This is purpose-aligned, but selected paths could overwrite existing local files.

Skill content

output_path.parent.mkdir(parents=True, exist_ok=True) ... output_path.write_text(...); ... if dry_run: return ... path.write_text("# Starter file\n", encoding="utf-8")

Recommendation

Run with --dry-run first, use a dedicated project or artifacts directory, and avoid --allow-outside-workspace unless you intentionally want writes outside the current workspace.