secure-mcp-install

SKILL.md

This skill provides a security-focused workflow for installing MCP servers from third-party sources. It implements a "trust but verify" approach: clone the repository at a specific commit, run automated security scans, perform manual review of critical areas, then install with updates disabled.

Review the output. Any HIGH severity findings require manual investigation before proceeding.

If approved, install the MCP server at the audited commit.

Esta habilidad debe usarse cuando el usuario solicita instalar o auditar un servidor MCP, especialmente de fuentes de terceros. Centrado en la seguridad: clona en confirmaciones fijadas, ejecuta análisis de seguridad. Fuente: hartreeworks/skill--secure-mcp-install.

Ver original