Why this verdict
- suspicious: finding skill:skills/mcp-builder:skills/mcp-builder/SKILL.md:193:CRED
- suspicious: finding skill:skills/mcp-builder:skills/mcp-builder/SKILL.md:200:SUPPLY
- suspicious: finding skill:skills/mcp-builder:skills/mcp-builder/SKILL.md:27:SUPPLY
- suspicious: finding skill:skills/mcp-builder:skills/mcp-builder/SKILL.md:94:SUPPLY
Security findings 4
Credential access
highContextual risklow confidenceThe 'Resources (Read-only Data)' template defines a file://{path} resource documented as 'Read a file from the workspace' whose code return open(path).read() actually opens any client-supplied path, teaching generated servers to expose unrestricted host file reads (reach to key/credential files) beyond the workspace scope its own text claims.
return open(path).read()
vector:codevector:instruction
Counter-argument considered
Kill case: this is a benign teaching template inside the declared build-an-MCP-server capability. Survive case: the template is what agents copy into generated servers, the client-controlled {path} flows unvalidated into open(), and it contradicts the template's own workspace-scoped, read-only framing (D3 safety claim), so no carve-out covers the unrestricted host-file-read behavior.
Supply chain
mediumContextual risklow confidenceThe testing instructions have the agent run npx @anthropics/mcp-inspector, which fetches and executes an unpinned remote package at test time whose scope/name does not match the officially documented inspector package, a typosquat-or-stale-name execution surface.
npx @anthropics/mcp-inspector python3 my_server.py
vector:instruction
Counter-argument considered
Kill case: running a test client is an ordinary part of the declared build workflow. Survive case: this is a concrete agent instruction to npx-fetch and execute an unpinned package at test time, the pinned-official-install carve-out does not apply to an unpinned run, and the artifact labels the package 'MCP Inspector' while its scope/name diverges from the officially documented inspector package, leaving the executed code undeclared.
Supply chain
mediumContextual risklow confidenceThe quick-start setup instructs installing the 'mcp' SDK from PyPI with no version pin, so the agent installs and runs whatever package code the registry serves at install time rather than a reviewed pinned version (undeclared unpinned dependency surface; official package name and registry, hence contextual_risk).
pip install mcp
vector:instruction
Counter-argument considered
Kill case: installing the official 'mcp' SDK is instrumental to the declared build capability and openly documented. Survive case: the carve-out covers pinned official-registry installs only; this command carries no version pin, so the code the registry serves and the agent executes at install time is undeclared, and the quick-start is a concrete agent instruction.
Supply chain
mediumContextual risklow confidenceThe TypeScript setup instructs installing @modelcontextprotocol/sdk via npm with no version pin, leaving the executed code to whatever the registry serves at run time (undeclared unpinned dependency surface; official package, hence contextual_risk).
npm install @modelcontextprotocol/sdk
vector:instruction
Counter-argument considered
Kill case: @modelcontextprotocol/sdk is the official package on the official registry and the install is openly documented as part of the declared build workflow. Survive case: the carve-out requires a pinned install; this command has no version pin, so the code executed at install/run time is whatever the registry serves, an undeclared dependency surface reached by a concrete setup instruction.
Open questions 1
What the analysis could not settle from the code alone.
Detector lead DET:a541a7eedc7dd142 claims an observed 'file_read ~/.claude/mcp.json' capability, but the cited unit only instructs adding an entry to that file; no read of the file or harvesting of its contents is shown, so the lead cannot be confirmed as a credential-access behavior from the evidence shown.
Credential access
Refuted findings 1
Candidates the review stage examined and rejected, kept for transparency.
Persistence
criticalRefutedlow confidenceThe skill instructs the agent/user to add a new server entry to the agent control-plane file ~/.claude/mcp.json, which persists the registered MCP server and causes python3 /path/to/my_server.py to auto-run on every Claude session; this matches the skill's declared purpose (adding tools to Claude), so it is reported as contextual risk rather than an established harm.
Add to `~/.claude/mcp.json`
Why it was refuted
Kill case wins: registering the just-built server in ~/.claude/mcp.json so it auto-runs in Claude sessions is exactly the target's declared purpose ('Use when user wants to create an MCP server, add tools to Claude'), openly taught as numbered step 'Register with Claude' rather than concealed; session auto-run is inherent to MCP registration, so the declared-core-capability carve-out neutralizes the persistence harm and the behavior is declared, not undeclared residue.
Coverage gaps 1
Parts of the artifact the static analysis could not fully examine.
context:unanalyzable_binary binary content is only byte-scanned
web/src/app/favicon.ico
