The Agent Skills Directory

[SAFE]: The skill is a security-focused educational and diagnostic tool. Its primary purpose is to harden MCP servers against known attack vectors like prompt injection, SSRF, and command injection.
[COMMAND_EXECUTION]: The scripts/security_checklist.py script uses subprocess.run to call git ls-files. This is a standard and safe implementation used locally to identify which files to scan for security issues within a developer's repository. It does not use attacker-controlled input for command construction.
[REMOTE_CODE_EXECUTION]: The skill correctly identifies and warns against remote code execution risks in the MCP ecosystem. It flags patterns like npx -y and @latest tags as dangerous in its checklist script and documentation. It does not perform any remote code execution itself.
[DATA_EXPOSURE]: The diagnostic script includes regex patterns to detect hardcoded credentials (API keys, AWS keys, private keys) in the user's local repository. This is a defensive security feature designed to prevent accidental data exposure before code is committed.
[SAFE]: The references/threats.md file provides high-quality security research, citing official specifications, CVEs, and institutional guidance (NSA, OWASP, CSA). All external links point to official and reputable security documentation sources.

mcp-server-security