secure-mcp-install

SKILL.md

This skill provides a security-focused workflow for installing MCP servers from third-party sources. It implements a "trust but verify" approach: clone the repository at a specific commit, run automated security scans, perform manual review of critical areas, then install with updates disabled.

Review the output. Any HIGH severity findings require manual investigation before proceeding.

If approved, install the MCP server at the audited commit.

當使用者要求安裝或審核 MCP 伺服器（尤其是來自第三方來源）時，應使用此技能。注重安全：在固定提交處進行克隆，執行安全掃描。 來源：hartreeworks/skill--secure-mcp-install。

查看原文