mcp-builder

• Outcome: Review
• Latest audit: Sep 23, 2026 · 6:32 AM UTC
• Version: 1.0.0

Overview

The skill is coherent MCP-building guidance, but its evaluation script can send MCP tool data to Anthropic and save detailed reports without strong scoping or warnings.

Review this skill before using it with real services. Run evaluations only against test or least-privilege MCP servers, avoid production tokens and sensitive data, assume tool outputs may be sent to Anthropic and saved in reports, and pin/audit dependencies before relying on the bundled scripts.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (27)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 93% confidence

Finding

The declared purpose presents the skill as documentation/guidance, but the instructions direct the agent to fetch remote content, run builds, launch servers, and perform evaluations against local or remote MCP endpoints. This mismatch is dangerous because users may invoke the skill expecting passive advice while it actually encourages active execution and network interaction, increasing the risk of unintended code execution, data exposure, or unsafe connections.

Content

No source excerpt is available for this finding.

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 76)May include surrounding context.

md

- [⚡ TypeScript Implementation Guide](./reference/node_mcp_server.md) - Node/TypeScript-specific best practices and examples

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 131)May include surrounding context.

md

- [⚡ TypeScript Implementation Guide](./reference/node_mcp_server.md) - Node/TypeScript-specific best practices and examples

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 189)May include surrounding context.

md

- [⚡ TypeScript Implementation Guide](./reference/node_mcp_server.md) - Node/TypeScript-specific best practices and examples

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 238)May include surrounding context.

md

- [⚡ TypeScript Implementation Guide](./reference/node_mcp_server.md) - Node/TypeScript-specific best practices and examples

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 315)May include surrounding context.

md

- [⚡ TypeScript Implementation Guide](./reference/node_mcp_server.md) - Node/TypeScript-specific best practices and examples

External Model or Provider Selection

High

• Category: Excessive Agency
• Confidence: 90% confidence

Finding

Skill selects an external model or provider that may use a different account or billing plan than the operator expects. Undisclosed model switches can cause unexpected cost or quota consumption.

Content

Scanner excerpt · reference/evaluation.md (reported line 488)May include surrounding context.

md

optional arguments:
  -h, --help            Show help message
  -t, --transport       Transport type: stdio, sse, or http (default: stdio)
  -m, --model           Claude model to use (default: claude-3-7-sonnet-20250219)
  -o, --output          Output file for report (default: print to stdout)

stdio options:

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · reference/mcp_best_practices.md (reported line 327)May include surrounding context.

md

**OAuth 2.1 Implementation:**
- Use secure OAuth 2.1 with certificates from recognized authorities
- Validate access tokens before processing requests
- Only accept tokens specifically intended for your server
- Reject tokens without proper audience claims
- Never pass through tokens received from MCP clients

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 82% confidence

Finding

The skill instructs the agent to use WebFetch, perform file creation, and work with MCP-related capabilities, but it does not declare any explicit tool scope such as allowed-tools or permissions. That omission weakens least-privilege controls and can cause the runtime to grant broader access than reviewers expect, especially when the skill is used in automated environments.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The activation criteria are broad ('use when building MCP servers to integrate external APIs or services') and do not clearly exclude execution-heavy or high-risk contexts. In practice, that increases the chance the skill will trigger in situations where an agent proceeds to fetch remote docs, create files, or run/testing server processes without sufficiently narrow user intent.

Content

No source excerpt is available for this finding.

Unrestricted Tool Access

Medium

• Category: Excessive Agency
• Confidence: 80% confidence

Finding

Skill grants unrestricted tool access without appropriate constraints. An agent with unfettered tool access can perform arbitrary actions including file modification, network requests, and code execution.

Content

Scanner excerpt · reference/evaluation.md (reported line 205)May include surrounding context.

md

After understanding the API and tools, USE the MCP server tools:
- Inspect content using READ-ONLY and NON-DESTRUCTIVE operations ONLY
- Goal: identify specific content (e.g., users, channels, messages, projects, tasks) for creating realistic questions
- Should NOT call any tools that modify state
- Will NOT read the code of the MCP server implementation itself
- Parallelize this step with individual sub-agents pursuing independent explorations
- Ensure each subagent is only performing READ-ONLY, NON-DESTRUCTIVE, and IDEMPOTENT operations

Whitespace Padding

Medium

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Content

Scanner excerpt · reference/mcp_best_practices.md (reported line 767)May include surrounding context.

md

The MCP specification defines the following annotations for tools:

| Annotation        | Type    | Default | Description                                                                                                                          |
| ----------------- | ------- | ------- | ------------------------------------------------------------------------------------------------------------------------------------ |
| `title`           | string  | -       | A human-readable title for the tool, useful for UI display                                                                           |
| `readOnlyHint`    | boolean | false   | If true, indicates the tool does not modify its environment                                                                          |

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · reference/node_mcp_server.md (reported line 594)May include surrounding context.

md

mcp = FastMCP("example_mcp")

# Constants
API_BASE_URL = "https://api.example.com/v1"
CHARACTER_LIMIT = 25000  # Maximum response size in characters

# Enums

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · reference/python_mcp_server.md (reported line 379)May include surrounding context.

md

mcp = FastMCP("example_mcp")

# Constants
API_BASE_URL = "https://api.example.com/v1"
CHARACTER_LIMIT = 25000  # Maximum response size in characters

# Enums

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

The example logs the raw user query and timestamp through ctx.log_info, which can leak user-supplied content into logs and observability pipelines. If queries contain secrets, personal data, or sensitive business terms, this guidance promotes unnecessary data exposure beyond the primary processing path.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The resource example builds a local path from an untrusted {name} parameter and opens it directly (./docs/{name}) without normalization, allowlisting, or traversal checks. In a real MCP server, this pattern can let callers read unintended local files via values like ../../etc/passwd, exposing secrets, source code, or configuration data.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

The SSE and HTTP connection paths accept arbitrary headers and establish outbound network connections, and tool calls/listing later use the resulting session. In this file there is no user-facing warning, logging, confirmation, or disclosure that request metadata such as headers and tool arguments may be sent to a remote server.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The evaluation harness explicitly instructs the model to include full tool inputs and outputs in its summaries and then incorporates those summaries into the report. If tools process secrets, personal data, tokens, internal documents, or API responses, this design can amplify and persist sensitive data exposure beyond the original tool invocation.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The prompt specifically requires the model to explain which tools were used, the inputs provided, and the outputs received. That requirement increases the chance that secrets or sensitive records handled during MCP evaluation are reproduced in natural-language summaries, making accidental disclosure more likely than a normal agent trace.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The script sends evaluation questions, prior conversation state, and tool interaction context to Anthropic via client.messages.create. In an MCP evaluation setting, those questions and tool outputs may contain confidential business data or credentials, so transmitting them to a third-party model provider without clear disclosure or minimization creates a real data exfiltration/privacy risk.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

On tool failure, the code captures the full exception text and traceback and returns it into the model conversation as tool output. Tracebacks often contain filesystem paths, environment details, request fragments, stack-local values, or secret-bearing error messages, so this can leak internal implementation details to the model and into downstream reports.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The generated report can contain questions, expected answers, model summaries, feedback, and serialized tool call metrics, and it is written directly to disk when --output is used. In this evaluation context, reports may become a durable copy of sensitive prompts, tool outputs, or operational details that can be accessed later by unintended parties.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

This markdown file includes examples for setting ANTHROPIC_API_KEY and later passing bearer tokens and GITHUB_TOKEN, but it does not warn readers to use test credentials, avoid committing secrets, or handle reports/config files carefully. Because the document explicitly guides users through credential-bearing evaluation workflows, a brief user warning about secret exposure and safe handling is missing.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 95% confidence

Finding

The dependency specification uses a lower-bound only constraint (anthropic>=0.39.0), which makes builds non-reproducible and can unexpectedly pull in vulnerable or breaking releases. In a security-sensitive project that helps build MCP servers interacting with external services, this increases supply-chain risk because the actually installed version may vary across environments and over time.

Content

Scanner excerpt · scripts/requirements.txt (reported line 1)May include surrounding context.

text

anthropic>=0.39.0
mcp>=1.1.0

Unverifiable Dependency: anthropic has 4 known advisory(ies) (CVE-2026-34450 (Claude SDK for Python has Insecure Default File Permissions in Local Filesystem ); CVE-2026-34452 (Claude SDK for Python: Memory Tool Path Validation Race Condition Allows Sandbox); CVE-2026-34450 (The Claude SDK for Python provides access to the Claude API from Python applicat) +1 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 88% confidence

Finding

The manifest references anthropic without pinning an exact version, so it is impossible to determine from this file whether the installed package includes fixes for the listed advisories. This is dangerous because environments may resolve to different releases, leaving some deployments exposed to known SDK issues while giving maintainers a false sense of safety.

Content

No source excerpt is available for this finding.