AgentStack
Sign in Publish
MCP servers Skills Toolkits Why AgentStack Sell Docs
Sign in
SKILL verified MIT Self-run

Mcp Safety Review

skill-arnie016-codex-prompt-templates-mcp-safety-review · by Arnie016

>

↗ Website ↗ Repository
— No reviews yet
0 installs
2 views
0.0% view→install

Install

$ agentstack add skill-arnie016-codex-prompt-templates-mcp-safety-review

✓ scanned · ✓ verified — works with Claude Code, Cursor, and more.

Security review

✓ Passed

No issues found. Passed automated security review. · v0.1.0 How review works →

  • ✓ Prompt-injection patterns
  • ✓ Secret / credential exfiltration
  • ✓ Dangerous shell & filesystem operations
  • ✓ Untrusted network calls
  • ✓ Known-malicious package signatures

What it can access

  • ● Network access Used
  • ✓ Filesystem access No
  • ✓ Shell / process execution No
  • ✓ Environment & secrets No
  • ✓ Dynamic code execution No

From automated source analysis of v0.1.0. “Used” means the capability is present in the source — more access means more to trust, not that it’s unsafe.

Are you the author of Mcp Safety Review? Claim this listing to set pricing, connect Stripe payouts, and keep 70% of every sale.
Sign up to claim

About

MCP Safety Review

Goal: decide whether a server/tool should be installed, sandboxed, modified, or rejected.

Review Phases

  1. Source: repo age, maintainer, license, release artifacts, install path.
  2. Runtime: language, dependencies, postinstall hooks, Docker privileges, shell execution.
  3. Data: files read, secrets touched, remote endpoints, telemetry.
  4. Tools: classify every MCP tool by read/write/destructive/account-control capability.
  5. Auth: API keys, OAuth, token storage, tenant boundaries, local-only claims.
  6. Blast radius: what the tool can change without human confirmation.

Severity

  • high: credential exposure, destructive actions without confirmation, account takeover path, arbitrary command execution from untrusted input.
  • medium: broad permissions, unclear auth boundary, unpinned remote code, weak logging of sensitive data.
  • low: missing docs, weak error handling, optional hardening.
  • info: posture notes without a concrete abuse path.

Output

# Safety Review
Verdict:
Severity:
Confidence:
Why it matters:
Evidence:
Required mitigations:
Install decision:

Hard rule: do not run raw binaries, zips, curl-piped scripts, or package installers from a fresh repo until this review is complete.

Pair With

  • $auto-skill-safety-mcp-secret-guard when configs, logs, or examples may

contain credentials.

  • $auto-skill-build-mcp-conformance-harness after the server is trusted and

the user needs repeatable CI/release gates.

Validation

  • Every exposed tool is classified by read/write/destructive/account-control capability.
  • Install/run decision states what was not executed.
  • Required mitigations are concrete enough to apply before trust is expanded.

Source & license

This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.

Install and usage instructions live in the source repository linked above.

Reviews

No reviews yet — be the first.

Write a review

Versions

  • v0.1.0 Imported from the upstream source.

More in AI & ML