The Agent Skills Directory

[COMMAND_EXECUTION]: The skill documents how to install the tool using cargo install and provides instructions for manual binary installation. These are standard developer operations and point to the official GitHub repository for the tool.
[PRIVILEGE_ESCALATION]: The configuration guide explicitly warns about the risks of project-level configuration files (mcpls.toml). It implements a "trust-project-config" gate that prevents mcpls from spawning arbitrary LSP server commands defined in a repository unless the user explicitly opts in via CLI flags or environment variables.
[DATA_EXPOSURE]: The skill documents an environment variable allowlist for child processes. It notes that the environment is cleared by default to prevent leaking sensitive information from the parent process to spawned LSP servers, which is a security best practice.
[REMOTE_CODE_EXECUTION]: While the tool spawns sub-processes (LSP servers), the documentation provides clear warnings about only trusting known configurations and provides a secure mechanism (SHA256 verification) for remote binary downloads.

mcpls