Mcp Builder

• Outcome: Pass
• Latest audit: Sep 15, 2026 · 12:47 AM UTC
• Version: 1.0.0

Overview

This skill is a coherent MCP server building and evaluation guide, with some disclosed development and privacy risks users should manage before running its optional evaluation tools.

Install only if you are comfortable with a development guide that may create MCP server projects and optionally run an evaluation harness. Run the evaluation scripts in an isolated environment, use least-privilege API keys, avoid evaluating servers with write/destructive tools unless intentionally testing them, redact sensitive tool outputs, and pin dependencies or use a lockfile before relying on the setup commands.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: scripts/requirements.txt:1

Finding

Unbounded Python Dependency Versions Permit Unsafe Supply-Chain Updates

Content

View full analysis

Vulnerability Details

File Location: scripts/requirements.txt:1-2; installation instructions at reference/evaluation.md:387-392
Vulnerability Type: Unpinned third-party dependencies
Risk Level: Medium

Vulnerable Code

scripts/requirements.txt:1-2:

text

anthropic>=0.39.0
mcp>=1.1.0

reference/evaluation.md:387-392:

bash

pip install -r scripts/requirements.txt

Or install manually:

bash

pip install anthropic mcp

Technical Analysis

Both dependencies use open-ended minimum-version constraints. Consequently, installation may resolve to any later package release, including versions that were never reviewed with this project. The documented manual installation command is less restrictive still and always resolves mutable package metadata from the configured Python package index.

Python package installation can execute package build backends and installation-related code. Therefore, compromise of an allowed future release, its publishing account, the configured package index, or dependency resolution path could turn the documented setup procedure into local code execution. No lockfile, exact version constraints, or package hashes are supplied to establish reproducible and integrity-verified installations.

This is a supply-chain weakness rather than evidence that the currently named anthropic or mcp packages are malicious.

Attack Path

1. An attacker compromises a package publisher, package-index account, future permitted release, or dependency-resolution source.
2. The attacker publishes a malicious version satisfying anthropic>=0.39.0 or mcp>=1.1.0.
3. A user follows the documented setup instructions and runs pip install -r scripts/requirements.txt or the unrestricted manual installation command.
4. The package resolver selects and downloads the malicious release.
5. Malicious build or package code executes in the installation or ...[truncated 493 chars]

Remediation

View remediation

Remediation Suggestions

• Pin every direct dependency to an exact, reviewed version.
• Generate and commit a lockfile that includes transitive dependencies.
• Require cryptographic hashes during installation, for example through a hash-locked requirements file and pip install --require-hashes.
• Perform dependency updates through a reviewed process with automated vulnerability, provenance, and license checks.
• Use an isolated virtual environment or container with minimal filesystem access and no unnecessary credentials.
• Replace the unrestricted manual installation example with the same reproducible, hash-verified installation procedure.

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:140

Finding

Unversioned npx Command Can Download and Execute Mutable Registry Code

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:140-141
Vulnerability Type: Unpinned executable development dependency
Risk Level: Medium

Vulnerable Code

text

**TypeScript:**
- Run `npm run build` to verify compilation
- Test with MCP Inspector: `npx @modelcontextprotocol/inspector`

Technical Analysis

The documented npx invocation does not specify a package version or require a locally locked installation. If the package is not already present locally, npx may retrieve the current package release from the configured npm registry and execute its entry point immediately.

The effective code executed by this instruction can therefore change after the Skill has been reviewed. A compromised publisher account, registry, dependency, or future package release could cause users following the testing instructions to execute attacker-controlled code. No lockfile or integrity metadata in this project constrains the Inspector package and its transitive dependency graph.

The Inspector is relevant to MCP testing, but retrieving an unreviewed mutable release at execution time exceeds the minimum necessary supply-chain exposure. A locally installed, version-locked tool would provide the same functionality with stronger reproducibility.

Attack Path

1. An attacker compromises the Inspector package, one of its dependencies, its publisher account, or the configured npm registry.
2. A malicious release becomes the version selected by the unversioned npx command.
3. A developer follows SKILL.md and runs npx @modelcontextprotocol/inspector.
4. npx downloads the mutable package release when it is not available in the local project.
5. The downloaded package entry point executes with the developer's local privileges.

Impact Assessment

Successful exploitation provides code execution as the user running the command. The code could read or modify files available to that account, access devel ...[truncated 288 chars]

Remediation

View remediation

Remediation Suggestions

• Add the Inspector as an exact-version development dependency in package.json.
• Commit the corresponding package-manager lockfile with integrity metadata.
• Invoke the locked local binary through an npm script rather than allowing npx to fetch a missing package.
• If npx remains necessary, specify an exact reviewed version and use controls that prevent implicit substitution of another release.
• Run inspection tools in an isolated environment with minimal filesystem permissions and no unrelated secrets.
• Periodically review and deliberately update the pinned package and its transitive dependencies.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (25)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The declared description presents the skill as a documentation guide, but the observed behavior includes broader operational capabilities such as connecting to MCP servers, invoking tools, and running evaluations via external services. This description-behavior mismatch can mislead users about the true authority and data flows of the skill, which is especially risky when external connections and automated tool invocation are involved.

Content

No source excerpt is available for this finding.

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 62)May include surrounding context.

md

- [⚡ TypeScript Guide](./reference/node_mcp_server.md) - TypeScript patterns and examples

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 83)May include surrounding context.

md

- [⚡ TypeScript Guide](./reference/node_mcp_server.md) - TypeScript patterns and examples

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 223)May include surrounding context.

md

- [⚡ TypeScript Guide](./reference/node_mcp_server.md) - TypeScript patterns and examples

External Model or Provider Selection

High

• Category: Excessive Agency
• Confidence: 90% confidence

Finding

Skill selects an external model or provider that may use a different account or billing plan than the operator expects. Undisclosed model switches can cause unexpected cost or quota consumption.

Content

Scanner excerpt · reference/evaluation.md (reported line 488)May include surrounding context.

md

optional arguments:
  -h, --help            Show help message
  -t, --transport       Transport type: stdio, sse, or http (default: stdio)
  -m, --model           Claude model to use (default: claude-3-7-sonnet-20250219)
  -o, --output          Output file for report (default: print to stdout)

stdio options:

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · reference/mcp_best_practices.md (reported line 158)May include surrounding context.

md

**OAuth 2.1**:
- Use secure OAuth 2.1 with certificates from recognized authorities
- Validate access tokens before processing requests
- Only accept tokens specifically intended for your server

**API Keys**:

Ssd 3

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The example directly instructs tools to ask users for API keys, which legitimizes credential collection through conversational prompts. This is especially dangerous in an agent-development guide because it can propagate insecure patterns across many derived MCP servers, enabling credential theft, mishandling, or reuse outside intended boundaries.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 92% confidence

Finding

The skill instructs the agent to create projects, write files, and interact with MCP-related capabilities, but it does not declare any explicit tool scope such as permissions or allowed-tools. That mismatch can cause the skill to run with broader ambient authority than users expect, increasing the chance of unintended file modification or external tool use.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 88% confidence

Finding

Using npx @modelcontextprotocol/inspector without pinning a version pulls the latest package at execution time, creating a supply-chain risk and making behavior non-reproducible. If the upstream package is compromised or introduces breaking changes, users could execute unexpected code during testing.

Content

No source excerpt is available for this finding.

Unrestricted Tool Access

Medium

• Category: Excessive Agency
• Confidence: 80% confidence

Finding

Skill grants unrestricted tool access without appropriate constraints. An agent with unfettered tool access can perform arbitrary actions including file modification, network requests, and code execution.

Content

Scanner excerpt · reference/evaluation.md (reported line 205)May include surrounding context.

md

After understanding the API and tools, USE the MCP server tools:
- Inspect content using READ-ONLY and NON-DESTRUCTIVE operations ONLY
- Goal: identify specific content (e.g., users, channels, messages, projects, tasks) for creating realistic questions
- Should NOT call any tools that modify state
- Will NOT read the code of the MCP server implementation itself
- Parallelize this step with individual sub-agents pursuing independent explorations
- Ensure each subagent is only performing READ-ONLY, NON-DESTRUCTIVE, and IDEMPOTENT operations

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · reference/node_mcp_server.md (reported line 601)May include surrounding context.

md

mcp = FastMCP("example_mcp")

# Constants
API_BASE_URL = "https://api.example.com/v1"

# Enums
class ResponseFormat(str, Enum):

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · reference/python_mcp_server.md (reported line 353)May include surrounding context.

md

mcp = FastMCP("example_mcp")

# Constants
API_BASE_URL = "https://api.example.com/v1"

# Enums
class ResponseFormat(str, Enum):

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

The logging example records the raw user query and timestamp through context logging. In MCP and agent workflows, queries may contain personal data, secrets, or business-sensitive terms, so demonstrating raw logging encourages unnecessary retention and exposure of user-supplied content in logs.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The guide explicitly demonstrates using ctx.elicit(..., input_type="password") to ask users for API keys inside a tool. In a skill whose purpose is to teach MCP server construction, this normalizes interactive collection of long-lived secrets through natural-language workflows, increasing phishing risk, accidental logging, and insecure secret handling by downstream implementations.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The resource example constructs ./docs/{name} and opens it directly without path normalization, allowlisting, or traversal checks. This teaches a pattern that can lead implementers to expose arbitrary local files via crafted resource names such as ../ sequences, causing unintended disclosure of host filesystem contents.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The stdio connection path launches an external command via StdioServerParameters(command=self.command, args=self.args, env=self.env), which is a subprocess/shell-adjacent operation covered by the missing-warning rule for code files. While the docstring describes the transport mechanically, there is no confirmation, logging, or explicit warning here that an external program will be executed with supplied arguments and environment variables.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

Both sse_client and streamablehttp_client initiate remote network communication, and subsequent tool calls/listing can transmit user-provided arguments or system-derived data to the configured endpoint. This file includes no warning, logging, or explanatory comment informing users that remote MCP servers will receive requests and headers.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The harness sends evaluation questions, tool schemas, and subsequent tool interaction content to Anthropic via client.messages.create. Because tool outputs may contain secrets, internal data, or sensitive business information gathered from connected MCP servers, this creates a real data exfiltration path to a third-party API that may exceed user expectations for a local evaluation utility.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The evaluation prompt explicitly requires the model to report every tool input and output in

tags. If tools access credentials, personal data, proprietary records, or other sensitive content, the generated report will intentionally echo that data, increasing exposure in API logs, terminal output, and saved report files.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The manifest describes this skill as a guide for building high-quality MCP servers, but this file implements an execution harness that can start arbitrary local stdio servers via user-supplied commands and environment variables. While evaluating MCP servers is related to development, the ability to spawn arbitrary processes is a distinct capability not justified by the manifest's narrowly instructional wording.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 82% confidence

Finding

This markdown file includes commands for exporting ANTHROPIC_API_KEY and later shows authorization headers and GitHub tokens, but it does not warn users that these are sensitive secrets that should not be committed, shared, or logged. Because the file is markdown, SQP-2 applies when descriptions omit warnings about behaviors affecting privacy or system integrity.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 97% confidence

Finding

The dependency is specified with a lower-bound range (anthropic>=0.39.0) instead of an exact version, which makes builds non-reproducible and can silently pull in different releases over time. In a security-sensitive MCP server context, this increases supply-chain risk and makes it harder to verify whether deployed environments are using vulnerable or fixed versions.

Content

Scanner excerpt · scripts/requirements.txt (reported line 1)May include surrounding context.

text

anthropic>=0.39.0
mcp>=1.1.0

Unverifiable Dependency: anthropic has 4 known advisory(ies) (CVE-2026-34450 (Claude SDK for Python has Insecure Default File Permissions in Local Filesystem ); CVE-2026-34452 (Claude SDK for Python: Memory Tool Path Validation Race Condition Allows Sandbox); CVE-2026-34450 (The Claude SDK for Python provides access to the Claude API from Python applicat) +1 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 90% confidence

Finding

The manifest does not pin the anthropic version, so there is no way to determine from this file whether the installed release includes fixes for known advisories. While the requirements file alone does not prove exploitation, the lack of version pinning prevents reliable vulnerability assessment and can result in deployment of an affected SDK version.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 98% confidence

Finding

The mcp package is unpinned (mcp>=1.1.0), allowing installation of any newer version that satisfies the constraint. Because this skill is specifically about building MCP servers that expose tools to external services, dependency drift in the MCP SDK can directly affect authentication, request handling, and protocol security behavior.

Content

Scanner excerpt · scripts/requirements.txt (reported line 2)May include surrounding context.

text

anthropic>=0.39.0
mcp>=1.1.0

Unverifiable Dependency: mcp has 12 known advisory(ies) (CVE-2025-53366 (MCP Python SDK vulnerability in the FastMCP Server causes validation error, lead); CVE-2025-66416 (Model Context Protocol (MCP) Python SDK does not enable DNS rebinding protection); CVE-2026-52870 (MCP Python SDK: Experimental task handlers allow any client to access and cancel) +9 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 95% confidence

Finding

The mcp dependency has known advisories, but the unpinned requirement means the actual installed version is unverifiable from this manifest. Given that this skill is for creating MCP servers, using an unknown SDK version is more dangerous because vulnerabilities in the protocol implementation or server framework could affect exposed tools, network handling, or client isolation.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.