The Agent Skills Directory

[SAFE]: The skill is entirely defensive, providing a structured approach for auditing MCP implementations for security flaws like path traversal, SSRF, and lack of authentication.
[EXTERNAL_DOWNLOADS]: The skill references official documentation and SDK repositories from the Model Context Protocol project (modelcontextprotocol.io and github.com/modelcontextprotocol). These are well-known, authoritative sources for this technology.
[COMMAND_EXECUTION]: While the skill mentions potentially dangerous commands like child_process.exec or subprocess.run, it does so to warn against their insecure usage and provides safe alternatives using argument arrays and validation.
[CREDENTIALS_UNSAFE]: The skill correctly identifies sensitive file paths (e.g., .env, .aws, .ssh) and instructs the agent to ignore them during resource listing, following security best practices.
[PROMPT_INJECTION]: The skill contains a 'Threat model recap' that explicitly educates the agent on the risks of indirect prompt injection and provides defensive strategies to mitigate these attacks.

mcp-server-security-scan