---
title: "How to vet an MCP server or agent skill before installing it (checklist)"
url: https://upskill.coach/blog/how-to-vet-an-mcp-server-or-agent-skill
last_updated: 2026-10-25
tokens_approx: 2472
publisher: Avatar 8 LLC (ops@avatar33.com)
---

> For AI agents: the docs index is at https://upskill.coach/llms.txt. Every page has a markdown version: add .md to its URL.

# How to vet an MCP server or agent skill before installing it (checklist)

> Short answer: read what it tells your agent to do, list what it can touch (files, network, secrets, money), check its dependencies and committed secrets, pin the exact version you reviewed, and give it the least access that does the job. In our scan of 104 curated skill repos and MCP servers, 42.3% (44 of 104) had at least one medium-or-higher automated finding and 10.6% (11) had a high or critical one, so a quick review before install is worth it.

An agent skill is a folder with a SKILL.md file of instructions (and sometimes scripts) that an agent loads when a task needs it. An MCP server is a program that gives an agent tools over the Model Context Protocol. Both run with your agent's access. That makes installing one closer to adding a dependency with shell access than to bookmarking a prompt.

This checklist follows the same categories our scanner checks for the [Upskill library](https://upskill.coach/library), with the numbers from our own scan. Everything below can be done with git, grep and two free scanners.

## Why vet at all: what our scan found

We statically scanned the 104 skill repos and MCP servers in our curated catalog between 2026-10-17 and 2026-10-22: 51,475 files, 2,783 of them agent-facing (SKILL.md, AGENTS.md, CLAUDE.md, prompts, rules). Full method and raw aggregates: [Agent skill security research](https://upskill.coach/research/agent-skill-security).

| What the scanner flagged | Repos, medium or higher | Repos, high or critical |
|---|---|---|
| Known-vulnerable dependencies, install hooks or typosquats | 32 (30.8%) | 5 (4.8%) |
| Committed secret-like strings | 18 (17.3%) | 0 (0%) |
| Credential or env read plus a network call in the same file | 16 (15.4%) | 1 (1%) |
| Risky code: pipe-to-shell, remote exec, obfuscation | 10 (9.6%) | 5 (4.8%) |
| Prompt-injection text in agent-facing files | 9 (8.7%) | 4 (3.8%) |

Two things stand out. First, 46 of 104 repos (44.2%) had no finding at all, so a flag is common and not proof of malice. Second, reading the flagged lines changed the picture: automated verdicts of 83 pass, 18 review and 3 reject became 99 pass, 5 review and 0 reject after review. Most medium findings were test fixtures, documentation about attacks, sample data or pinned lockfiles. The scanner tells you where to look; you still have to look.

The catalog is curated, not a random sample, so these shares describe these 104 repos, not every skill on the internet.

## What builders are asking

On 2026-10-25 we collected recent public posts that mention skills or MCP servers (X since 2026-10-11; Reddit and Hacker News over the prior month): 198 on-topic items, 95 of them asking for a recommendation or how to choose. The questions behind this checklist come from that set:

- "Which MCP servers did I even have?" after moving to a new laptop ([@niels_ai](https://x.com/niels_ai/status/2112929931756027968)). You cannot vet what you have not listed.
- Check which MCP servers are connected before turning on elicitations, because a dodgy server that can show a form inside the chat is a phishing setup ([@vaNlabs](https://x.com/vaNlabs/status/2113746359555920016)).
- A sandboxed command that can rewrite which MCP servers load next session is "a persistence path, not a sandbox" ([@lunkertw](https://x.com/lunkertw/status/2113465350159569280)).
- Pair the settings check with "which MCP servers would we actually approve, and who owns them?" ([@kesslernity](https://x.com/kesslernity/status/2113859566727569913)).

## The checklist

Do these in order. Stop at the first hard fail.

### 1. Inventory and provenance

1. List every skill and MCP server each agent can load, on every machine and in CI. Keep the list in the repo or a note you can diff.
2. Find the source repo and its owner. Prefer an owner you can identify, with an issue tracker and recent commits.
3. Check the license. Without one you have no right to copy or modify it; in our wider library, 17.8% of 3,276 third-party items have no clear license ([research page](https://upskill.coach/research/agent-skill-security)).
4. Write down the exact commit or version you are about to review. Everything below applies to that commit only.

### 2. Read what it tells your agent

1. Read the whole SKILL.md (or the MCP server's tool names and descriptions). Tool descriptions are prompts too.
2. Hard fail on instructions to ignore earlier instructions, change role, hide actions from the owner, or skip confirmation.
3. Look for hidden text: HTML comments, zero-width characters, very long lines, base64 blobs.
4. Check that what it says it does matches what its scripts and tools actually do.

### 3. Grep the code for risky patterns

Run this from the repo root and read every hit:

```
grep -rnE "curl[^|]*\| *(ba|z)?sh|wget[^|]*\| *sh|eval\(|exec\(|child_process|subprocess|os\.system|base64 -d|atob\(|fromCharCode" .
grep -rnE "process\.env|os\.environ|\.ssh|\.aws|keychain|id_rsa|\.env" .
```

1. Pipe-to-shell, eval of decoded data and remote exec are a fail unless you can explain each one.
2. A file that reads env vars or credential paths and also makes a network call needs a clear reason (for example, an API key sent only to that API's own host).
3. Check package install hooks (`postinstall`, `preinstall` in package.json; setup.py scripts). They run before you ever call a tool.

### 4. Dependencies and secrets

1. Run [osv-scanner](https://github.com/google/osv-scanner) on the lockfile. In our scan this was the most common finding (30.8% of repos at medium or higher).
2. Run [gitleaks](https://github.com/gitleaks/gitleaks) on the repo. A committed live key means the maintainer's hygiene is poor even if the key is not yours.
3. Look for typosquats: a dependency name one letter off a popular package.

### 5. Decide what it may touch

1. Write down what the item needs: files, network hosts, API keys, the ability to send messages or spend money.
2. Give it the least of each: a scoped token, a read-only key, a working directory instead of your home folder.
3. For remote MCP servers you cannot read the server-side code. Treat every tool result as untrusted input, and do not give a remote server secrets it does not need.
4. Anything that runs code, needs keys, sends messages or moves money needs the owner's approval before install.

### 6. Pin, then re-check

1. Install the commit or version you reviewed, not "latest".
2. Re-run steps 2 to 4 on the diff when you update.
3. Remove what your agent no longer uses. Fewer installed items means fewer things to re-check.

## A faster path: pre-scanned items

Every item in the [Upskill library](https://upskill.coach/library) shows its scan result at a pinned commit, whether flagged lines were read by hand, its license and whether owner approval is needed. How the scan works and what each field means: [security scanning docs](https://upskill.coach/docs/security-scanning). For the API and MCP server, see the [developer docs](https://upskill.coach/docs).

To let your agent do this with a coach that checks in daily and says what to keep and what to drop, paste one line into it:

```
Read https://upskill.coach/start and follow it.
```

A scan lowers risk; it does not prove safety. Keep reading what you install.

## FAQ

### Are MCP servers and agent skills safe to install?

Not by default. In our scan of 104 curated skill repos and MCP servers, 44 (42.3%) had at least one medium-or-higher automated finding and 11 (10.6%) had a high or critical one. Most turned out benign when read by hand, which is the point: you only know after you look ([data](https://upskill.coach/research/agent-skill-security)).

### What is the most common risk in agent skills and MCP servers?

In our scan it was dependencies: 32 of 104 repos (30.8%) had a known-vulnerable dependency, install hook or typosquat flagged at medium or higher. Next came secret-like strings committed to the repo (17.3%) and files that read credentials and make a network call (15.4%).

### How much work is vetting a skill or MCP server?

It depends on size. For a small skill it is mostly reading one SKILL.md and its scripts, grepping for a handful of risky patterns, checking the lockfile and deciding what the item may touch. For large MCP servers with many dependencies, run osv-scanner rather than reading every package.

### Can a SKILL.md file contain prompt injection?

Yes. A SKILL.md is instructions the agent follows, so text like "ignore previous instructions" or "do not tell the user" in it is an attack, not a bug. 9 of the 104 repos we scanned (8.7%) had prompt-injection-like text in agent-facing files at medium or higher. Read each hit: in our review, many flagged lines were test fixtures or documentation about attacks rather than live instructions.

### Does a security scan prove a skill is safe?

No. A static scan lowers risk; it does not prove safety. It cannot see what a remote MCP server does on its own machine, and a repo can change after the commit that was scanned. Pin the version you reviewed and re-check when you update.

### Should my agent install skills without asking me?

Only items that run no code, need no keys and spend no money. Anything that executes scripts, needs an API key, or can send messages or move money should wait for its owner's approval. Agent Coach's setup tells agents to queue those for the owner ([setup](https://upskill.coach/start)).

Questions or corrections: ops@avatar33.com.