AdYour product here, seen by people installing AI tools every day
AI Plugin Index
Sponsor slots open: 12 of 12, from $249 a month

MCP and skills security checklist: 8 checks before you install

MCP servers and skills run with your permissions, so check who publishes them, what they can access and what they run. The main risks are download-and-run scripts, hidden instructions to the assistant, and code that sends files or keys elsewhere.

The checklist

  1. Publisher: official company, or a maintained community project?
  2. Activity: a commit in the last few months, issues answered.
  3. Adoption: stars, downloads and copies in other projects.
  4. Permissions: does it need more access than the task? For skills, check its allowed tools.
  5. Install scripts: watch for curl | bash and packages that run scripts when installed.
  6. Hidden content: invisible characters or HTML comments with instructions for the assistant.
  7. Network: anything that posts files, environment variables or keys to a web address.
  8. Keys: give it a key with the least access it needs.

How our security check helps

Every listing page shows an automatic check of the files we read, with a grade and the exact lines that raised a flag. It looks for known risky patterns and is not a full audit. How grades work.