MCP Server Development & Monetization Guide: Build, Publish, and Profit from the Tool Integration Standard

• Analyzed: Apr 15, 2026, 7:22 AM
• Findings: 1
• Version: 1.3.1
• Hash: acba05069388ecf28809ecc9971588f444c84eaff0aec23850da8c4be24a25ca
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill bundle is a technical guide for MCP server development but is classified as suspicious due to an unnecessary and contradictory request for a 'STRIPE_API_KEY' in the 'SKILL.md' metadata. While the guide text claims no API key is needed for its sandbox (https://sandbox.greenhelix.net), the metadata mandates the credential in the environment configuration. This unnecessary collection of sensitive secrets for a non-executable guide ('executable: false') increases the risk of credential theft or accidental leakage by the AI agent, as there is no functional reason for the agent to possess this key while simply providing documentation.