Security Audit

mcp-builder

github.com/anthropics/skills

AI SkillCommit 1ed29a03dc85

TRUSTED

Scanned 9 days ago

Critical

Immediate action required

High

Priority fixes suggested

Medium

Best practices review

Low

Acknowledged / Tracked

Trust Assessment

mcp-builder received a trust score of 86/100, placing it in the Mostly Trusted category. This skill has passed most security checks with only minor considerations noted.

SkillShield's automated analysis identified 2 findings: 0 critical, 0 high, 2 medium, and 0 low severity. Key findings include Unpinned Python dependency version.

The analysis covered 4 layers: dependency_graph, manifest_analysis, llm_behavioral_safety, static_code_analysis. All layers scored 70 or above, reflecting consistent security practices.

Last analyzed on February 11, 2026 (commit 1ed29a03). SkillShield performs automated 4-layer security analysis on AI skills and MCP servers.

Layer Breakdown

Manifest Analysis

100%

Static Code Analysis

100%

Dependency Graph

86%

LLM Behavioral Safety

100%

Security Findings2

Severity	Finding	Layer	Location
MEDIUM	Unpinned Python dependency version Requirement 'anthropic>=0.39.0' is not pinned to an exact version. Pin Python dependencies with '==<exact version>'.	Unknown	/var/folders/1k/67b8r20n777f_xcmmm8b7m5h0000gn/T/skillscan-clone-4nhhz4uq/repo/skills/mcp-builder/scripts/requirements.txt:1
MEDIUM	Unpinned Python dependency version Requirement 'mcp>=1.1.0' is not pinned to an exact version. Pin Python dependencies with '==<exact version>'.	Unknown	/var/folders/1k/67b8r20n777f_xcmmm8b7m5h0000gn/T/skillscan-clone-4nhhz4uq/repo/skills/mcp-builder/scripts/requirements.txt:2

Scan History

Embed Code

[![SkillShield](https://skillshield.io/api/v1/badge/82d5535499d6d378.svg)](https://skillshield.io/report/82d5535499d6d378)