anthropics/claude-plugins-official build-mcp-app

Checked the catalogued skill at build-mcp-app.

SkillTrust corpus scan 7 November 2026 v0.13.0 via skillsh Verify on GitHub

D AI-triaged 15

D Security

D; retained sample includes a high finding · SD-022 · what this rule accepts as a false positive →

D Permissions

D; retained sample includes a high finding · SD-003 · what this rule accepts as a false positive →

A Transparency

A set by no findings on this axis

showing 10 of 15

permission_hygienehigh SD-003

SKILL.md

securityhigh SD-022

SKILL.md

securityhigh SD-022

SKILL.md

securityhigh SD-022

SKILL.md

securityhigh SD-022

SKILL.md

securityhigh SD-022

SKILL.md

securityhigh SD-022

SKILL.md

securityhigh SD-022

SKILL.md

securityhigh SD-022

SKILL.md

securityhigh SD-022

SKILL.md

2 suppressed by AI triage

securityhigh SD-007 benign_example

references/iframe-sandbox.md

The function simply fetches an image from a CDN and returns it as a data URL, a legitimate and benign outbound network call.

securityhigh SD-022 benign_example

references/payload-budgeting.md

The scanner matched a DNS exfiltration pattern, but the actual context shows no DNS activity, indicating a false positive.