Mcp Builder test

• Outcome: Review
• Latest audit: Sep 16, 2026 · 7:58 AM UTC
• Version: 0.1.1

Overview

The skill is a coherent MCP-building guide, but its optional evaluation harness can send full MCP tool results to Anthropic and can call any exposed MCP tool without enforcing read-only limits.

Review this skill carefully before installing if you plan to run the evaluation harness against real or production MCP servers. Use test data or narrowly scoped read-only credentials, avoid exposing destructive tools during evaluation, treat tool outputs as data that may be sent to Anthropic and copied into reports, and pin dependencies before running the scripts.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/evaluation.py:117

Finding

Unrestricted Disclosure of MCP Tool Results to an External Model API

Content

View full analysis

tags, you must explain: - The steps you took to complete the task - Which tools you used, in what order, and why - The inputs you provided to each tool - The outputs you received from each tool - A summary for how you arrived at the response ``` ### Technical Analysis The evaluation harness serializes every MCP tool result and submits it to Anthropic through `client.messages.create`. It performs no field-level redaction, secret detection, data classification, output-size restriction, tool allowlisting, or confirmation before transmission. Sending tool results to a model is necessary for model-based evaluation. However, forwarding the complete result exceeds minimum privilege when the ...[truncated 2333 chars]

Remediation

View remediation

T08 · Insecure Dependencies

Warning

• Location: scripts/requirements.txt:1

Finding

Unpinned Third-Party Dependencies Permit Unreviewed Future Releases

Content

View full analysis

=0.39.0 mcp>=1.1.0 ``` The associated installation guidance executes this dependency specification directly: ```bash pip install -r scripts/requirements.txt ``` ### Technical Analysis Both dependencies use open-ended minimum-version constraints. As a result, installation can resolve to any future release satisfying the lower bound rather than to a version that was reviewed with this project. This creates non-reproducible installations and expands the trusted codebase over time without a corresponding review of the Skill. The affected packages execute in the same Python process as the evaluation harness and therefore inherit access to: - `ANTHROPIC_API_KEY` - MCP connection headers and environment variables - Evaluation questions and expected answers - MCP tool schemas and returned data - Local files accessible to the evaluating user - Network access available to the process No evidence was found that the currently named packages are malicious. The vulnerability is the absence of version and integrity controls, which leaves future installation behavior dependent on mutable package-index state. ### Attack Path 1. A user follows the documented setup instructions. 2. `pip` resolves `anthropic>=0.39.0` and `mcp>=1.1.0` against the configured package index. 3. A future compromised, malicious, or incompatible release satisfies the open-ended constraint. 4. The package is installed without requiring a change to the audited Skill package. 5. When the evaluation script imports the dependency, package code executes with the privileges and environment of the user. 6. A compromised dependency could read API credentials, inspect MCP traffic, access user-readable files, or make arbitrary outbound network requests. A similar path ...[truncated 710 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (20)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 92% confidence

Finding

The declared description presents the skill as a development guide, but the detected behavior indicates materially broader capabilities such as connecting to live MCP servers, executing tools, parsing evaluation files, and invoking external model APIs. This mismatch is dangerous because operators may grant trust or permissions based on the benign description while the skill can drive networked execution and data processing beyond what is transparently disclosed.

Content

No source excerpt is available for this finding.

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 62)May include surrounding context.

md

- [⚡ TypeScript Guide](./reference/node_mcp_server.md) - TypeScript patterns and examples

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 83)May include surrounding context.

md

- [⚡ TypeScript Guide](./reference/node_mcp_server.md) - TypeScript patterns and examples

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 223)May include surrounding context.

md

- [⚡ TypeScript Guide](./reference/node_mcp_server.md) - TypeScript patterns and examples

External Model or Provider Selection

High

• Category: Excessive Agency
• Confidence: 90% confidence

Finding

Skill selects an external model or provider that may use a different account or billing plan than the operator expects. Undisclosed model switches can cause unexpected cost or quota consumption.

Content

Scanner excerpt · reference/evaluation.md (reported line 488)May include surrounding context.

md

optional arguments:
  -h, --help            Show help message
  -t, --transport       Transport type: stdio, sse, or http (default: stdio)
  -m, --model           Claude model to use (default: claude-3-7-sonnet-20250219)
  -o, --output          Output file for report (default: print to stdout)

stdio options:

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · reference/mcp_best_practices.md (reported line 158)May include surrounding context.

md

**OAuth 2.1**:
- Use secure OAuth 2.1 with certificates from recognized authorities
- Validate access tokens before processing requests
- Only accept tokens specifically intended for your server

**API Keys**:

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 90% confidence

Finding

The skill instructs the agent to create projects, fetch external documentation, and produce evaluation artifacts, but it declares no explicit tool scope or permission boundaries. In an agent environment, missing scope declarations can allow broader-than-expected file writes or MCP interactions, increasing the chance of unintended external access or local modification.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 85% confidence

Finding

Using npx @modelcontextprotocol/inspector without a pinned version causes execution of whatever package version is current at install time. This creates a supply-chain risk: a compromised or incompatible future release could execute unexpected code during testing.

Content

No source excerpt is available for this finding.

Unrestricted Tool Access

Medium

• Category: Excessive Agency
• Confidence: 80% confidence

Finding

Skill grants unrestricted tool access without appropriate constraints. An agent with unfettered tool access can perform arbitrary actions including file modification, network requests, and code execution.

Content

Scanner excerpt · reference/evaluation.md (reported line 205)May include surrounding context.

md

After understanding the API and tools, USE the MCP server tools:
- Inspect content using READ-ONLY and NON-DESTRUCTIVE operations ONLY
- Goal: identify specific content (e.g., users, channels, messages, projects, tasks) for creating realistic questions
- Should NOT call any tools that modify state
- Will NOT read the code of the MCP server implementation itself
- Parallelize this step with individual sub-agents pursuing independent explorations
- Ensure each subagent is only performing READ-ONLY, NON-DESTRUCTIVE, and IDEMPOTENT operations

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · reference/node_mcp_server.md (reported line 601)May include surrounding context.

md

mcp = FastMCP("example_mcp")

# Constants
API_BASE_URL = "https://api.example.com/v1"

# Enums
class ResponseFormat(str, Enum):

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · reference/python_mcp_server.md (reported line 353)May include surrounding context.

md

mcp = FastMCP("example_mcp")

# Constants
API_BASE_URL = "https://api.example.com/v1"

# Enums
class ResponseFormat(str, Enum):

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The resource example constructs a local filesystem path directly from the untrusted name parameter (./docs/{name}) and reads it without validation. In an MCP server guide, this can teach implementers an unsafe pattern that enables path traversal such as ../ sequences, potentially exposing arbitrary local files to MCP clients.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The system prompt explicitly requires the model to include every tool input and output in the

, which can cause secrets, tokens, personal data, or proprietary content handled by MCP tools to be echoed into the final report. Because this harness evaluates external-service integrations and persists summaries/feedback, the skill context makes the issue more dangerous: sensitive runtime data may be exposed in logs, stdout, or saved reports even when the task itself did not require disclosure.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The documentation explicitly mandates the {service}-mcp-server naming convention, yet the example code later uses example-mcp as the server name. This is an active contradiction between the guide's stated requirement and the implementation example it provides.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The checklist explicitly requires 'No use of any type', but earlier examples use makeApiRequest<any>, cast callback data as user: any, and define parameters as data?: any and params?: any. This is a direct contradiction between the guide's stated TypeScript standard and the code it demonstrates.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 80% confidence

Finding

This code writes a generated evaluation report to the path supplied by the user, but the write operation itself has no inline warning, confirmation, or explanatory comment/docstring about overwriting or creating files. For code-file SQP-2, file writes can be flagged when they lack any local disclosure and are not otherwise clearly warned about in the file.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 97% confidence

Finding

The dependency specifier anthropic>=0.39.0 is unpinned, so builds may resolve to different versions over time, including versions with newly introduced regressions or security issues. In a security-sensitive skill for building MCP servers, supply-chain predictability matters because generated or supporting scripts may install whatever latest compatible release is available.

Content

Scanner excerpt · scripts/requirements.txt (reported line 1)May include surrounding context.

text

anthropic>=0.39.0
mcp>=1.1.0

Unverifiable Dependency: anthropic has 4 known advisory(ies) (CVE-2026-34450 (Claude SDK for Python has Insecure Default File Permissions in Local Filesystem ); CVE-2026-34452 (Claude SDK for Python: Memory Tool Path Validation Race Condition Allows Sandbox); CVE-2026-34450 (The Claude SDK for Python provides access to the Claude API from Python applicat) +1 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 91% confidence

Finding

The manifest does not pin anthropic, so it is impossible to verify whether the installed version is affected by any of the listed advisories. While this file does not prove an exploitable vulnerable version is installed, the inability to verify package safety is itself a supply-chain risk because deployment may resolve to an affected release.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 98% confidence

Finding

The dependency specifier mcp>=1.1.0 is unpinned, which makes installations non-reproducible and can silently pull in newer vulnerable or behavior-changing MCP SDK releases. This is more concerning here because the skill is specifically about creating MCP servers, where the SDK directly affects network-exposed tooling and protocol handling.

Content

Scanner excerpt · scripts/requirements.txt (reported line 2)May include surrounding context.

text

anthropic>=0.39.0
mcp>=1.1.0

Unverifiable Dependency: mcp has 12 known advisory(ies) (CVE-2025-53366 (MCP Python SDK vulnerability in the FastMCP Server causes validation error, lead); CVE-2025-66416 (Model Context Protocol (MCP) Python SDK does not enable DNS rebinding protection); CVE-2026-52870 (MCP Python SDK: Experimental task handlers allow any client to access and cancel) +9 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 95% confidence

Finding

The mcp package has known advisories, and because the manifest leaves the version open-ended, consumers may install an affected release without realizing it. Given this skill's purpose is to build MCP servers, exposure in the MCP SDK is especially relevant because vulnerabilities there can affect server validation, client handling, and network security boundaries.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.