Skill and MCP Installation Safety Review
Get an evidence-backed review of skills and MCP servers for prompt injection, credential theft, unsafe execution, and permissions.
Before & after
Same prompt, same agent — the only difference is the skill.
I can look at that skill and give you some general guidance on safety. You'd want to check things like what permissions it requests, whether the code looks suspicious, and if the creator is trustworthy. I could review it for obvious red flags, but a complete security audit would require a deep dive into the code. If you share the skill with me, I can give you some thoughts on potential issues. Are there specific concerns you have about it?
SAFETY EVALUATION REPORT: Third-Party Skill
OVERALL RISK RATING: LOW (green flag)
FILE SCAN
Total files: 23
JavaScript: 18 files
JSON configs: 4 files
Markdown: 1 file
Compiled/binary: 0 files (good sign)
PERMISSION AUDIT
Requested capabilities:
- Read files from /Users/./project (SAFE - project-scoped)
- Write to /tmp/output (SAFE - temp directory)
- Network: api.example.com (APPROVED - whitelisted domain)
- Environment access: API_KEY, DATABASE_URL (CAUTION - requires audit)
PROMPT INJECTION SCAN
Regex patterns checked: 847
Suspicious patterns found: 2 (low severity)
- Pattern: eval() appears 0 times (good)
- Pattern: exec() in shell command: 1 instance, context verified (safe)
- Dynamic import: 1 instance, path is hardcoded (safe)
- String interpolation in SQL: 0 instances (good)
DEPENDENCY CHECK
npm dependencies: 12 total
Known CVEs: 0
Outdated packages: 2 (not critical)
- lodash@4.17.15 (update available to 4.17.21, no CVE impact)
FLAGGED PATTERNS
1. File reads from process.env.USER_HOME (line 47)
Risk: Could expose ~/.ssh or ~/.aws credentials
Verdict: Mitigated (code validates path before read, good defensive coding)
2. No HTTPS validation in fetch() calls (line 89)
Risk: MITM attack possible on api.example.com
Verdict: Require https:// in env var or reject
RECOMMENDATION: SAFE TO INSTALL with these conditions:
- Verify API endpoint is HTTPS-only in your .env
- Run skill in sandboxed environment first
- Monitor file access logs for 1 week
- Pin to version 1.2.0 (latest tested)
Creator reputation: 8 skills published, 150+ stars on GitHub, no reported issuesAbout this skill
“Is this skill safe to install?” requires more than a search for suspicious words. This review traces what a skill or MCP server can read, execute, change, and transmit, then separates demonstrated risks from ordinary functionality and missing evidence.
What it does
- Detects attempts to override your instructions, conceal actions, bypass approval, or transmit private data.
- Traces credential reads, shell execution, filesystem writes, and network destinations back to their stated purpose.
- Reviews installation commands, startup behavior, dependencies, and remote downloads without executing candidate code.
- Checks whether MCP tool descriptions and implementations agree about permissions and side effects.
- Compares updates for new destinations, permissions, execution paths, and behavior drift.
- Produces severity-ranked findings with exact evidence, concrete fixes, and explicit review limits.
What you get
A compact installation decision followed by actionable findings and a coverage statement. Each finding explains the triggering evidence, the required conditions, the possible impact, and how to remove or constrain the risk.
Best for
People evaluating third-party Claude skills or MCP servers before granting access to local files, credentials, connected accounts, or production systems.
SKILL.md preview
---
name: skill-and-mcp-installation-safety-review
description: Reviews third-party Claude skills and MCP servers before installation or upgrade using static instruction analysis, data-flow tracing, permission checks, and dependency inspection. Use when the user says "is this skill safe to install", "check this MCP server", "scan this SKILL.md for prompt injection", "does this extension steal credentials", "review this skill update", "audit my installed skills", or "this skill keeps asking for unrelated permissions".
---
# Skill and MCP Installation Safety Review
… (sign up to view the full skill)More development skills
View all Development skills →Threat Hunting and IOC Triage
Turn telemetry and threat indicators into scoped hunts, evidence-backed findings, and prioritized investigation steps.
Secrets Vault Setup, Rotation, and Access Audits
Set up managed secret stores, wire workload access, rotate credentials safely, and audit least-privilege policies.
Application Penetration Test and Fix Plan
Assess application and API vulnerabilities with reproducible evidence, exploitability rankings, specific fixes, and retest steps.
Application Security Triage and Remediation
Turn code, dependency, and control findings into evidence-backed priorities, safe fixes, and verification plans.