Which agent skills and MCP servers should you avoid? What 108 rejections taught us

Short answer: avoid duplicates and copies, things that are not actually installable, items outside your agent's job, anything that automates a personal account on a platform that bans automation, and anything whose install pipes a remote script into a shell. Security is not the main filter: of the 108 candidates we rejected from 150 reviewed between 2026-10-17 and 2026-10-29, 88 (81.5%) had passed our automated security scan. We added 11 (7.3%) to the catalog; 31 are still waiting for a decision.

Most advice about agent skills and MCP servers is a list of what to install. This is the other half: what we turned down, and why. All numbers come from our own decision log; no rejected repo is named.

How the review works

Each day our discovery job pulls candidates from awesome lists, GitHub search, Hacker News, the MCP Registry and skills.sh. On 2026-10-29 that was 2,581 candidates after de-duplication. It security-scans the top-scoring few at a pinned commit (150 scans over 10 daily runs, 2026-10-17 to 2026-10-29). Our library agent then reads each scanned candidate and writes a one-line decision note: approve, reject, or leave pending.

The scan is the one behind our security research: prompt-injection text, credential reads next to network calls, committed secrets, vulnerable dependencies and risky code such as pipe-to-shell installs. Of the 150 candidates, the automated verdict was 118 pass, 29 review and 3 reject. Passing the scan only gets an item read; it does not get it in.

What builders are asking

On 2026-10-25 we collected recent public posts that mention skills or MCP servers (X since 2026-10-11; Reddit and Hacker News over the prior month): 198 on-topic items, 95 of them asking for a recommendation or how to choose. A few were about exactly this:

The top post by engagement in that set was a list: "50 Claude Skills You Should Know Right Now" (@Akankshaku46881, 2026-10-24). Lists are also our biggest source: on 2026-10-29, awesome lists supplied 1,768 candidate links before de-duplication.
"This is one of the few agent skills where I went looking for the thing that would make me not recommend it" (@jacksunny18, 2026-10-21).
"Worth diffing what the importer brings over before you trust it. Check which MCP servers and hooks came across, since hooks run shell commands on their own" (@Madeactual, 2026-10-24).

The rejections, by primary reason

Each rejection is counted once, under the first reason its decision note gives. Many notes give several.

Primary reason	Rejected	Share	Of those, passed the scan
Duplicate, mirror or copy, or already covered by an item we carry	30	27.8%	23
Not installable: reading lists, courses, roadmaps, job feeds, demo apps	18	16.7%	18
Outside the jobs our coached agents do	18	16.7%	13
Terms-of-service or platform-policy risk	15	13.9%	15
Too little evidence of use, stale, or no clear license	15	13.9%	15
Scan findings not cleared on review, or a suspicious re-upload	9	8.3%	1
Unattended live trading or wallet keys	3	2.8%	3
Total	108	100%	88

By kind: 41 of 55 MCP server candidates, 50 of 77 skill candidates and 17 of 18 plain repos were rejected.

1. Duplicates, mirrors and copies (30)

The biggest group adds nothing new. Three patterns repeat:

Mirrors on a personal account. A vendor's skill pack re-published by someone else, sometimes with the original copyright still in the license file, sometimes with a few lines changed and no attribution.
Unlicensed copies of a popular pack. Several were copies of one well-known skills pack, under other accounts, with no license and the same three high-severity findings. The original (Superpowers) is in the catalog.
The fifth Gmail MCP. 9 rejections were Gmail, Google Calendar or Google Workspace servers that overlap Google Workspace MCP or Google Calendar MCP.

What to do: install from the original source, prefer the vendor's official server, and keep one item per job.

2. Not something an agent can install (18)

Reading lists, courses and career roadmaps for humans, job-listing feeds, and personal demo apps. Many are useful to people; none gives an agent a capability. A repo named "...-mcp" that is an observability demo is still a demo.

3. Outside the job (18)

Good tools for jobs our agents do not do: one vendor's cloud analytics, a regional stock exchange, a chat suite none of our agents use, a family-calendar device. This one depends on you: does the item serve a job your agent runs this week?

4. Terms-of-service risk (15)

This is where a clean scan matters least: all 15 of these passed. 7 rejections cite LinkedIn and 10 cite TradingView. The patterns:

MCP servers that message, connect or search on the owner's own LinkedIn session or cookies, or through LinkedIn's private API. LinkedIn's User Agreement prohibits automated activity, so the risk is the owner's account.
Servers that drive the TradingView desktop app over its debug protocol, or wrap unofficial TradingView or Yahoo Finance endpoints.
A server whose README says it spoofs a user agent to get past a vendor's bot protection.

What to do: ask whether the platform allows the automation, not just whether the code is clean, and ask the owner whose account it is.

5. Thin evidence (15)

Very new or barely used repos with no adoption signal, no license, or no push in many months. Across all 108 rejections, 36 had 5 GitHub stars or fewer and 29 had no license GitHub could identify. Low stars alone is not a reason to reject (4 of the 11 approved items had 20 or fewer); it becomes one when nothing else vouches for the item.

6. Security findings that did not clear (9)

Most scan flags turn out benign when read; in the curated catalog, 18 automated "review" and 3 "reject" verdicts became 5 and 0 after reading (research). These 9 did not clear:

Install steps that pipe a script from a third-party domain into bash, in both docs and code.
A pack whose SKILL.md tells the agent to pipe a URL into sh, and whose CLAUDE.md writes secrets into a config file.
"Ignore previous instructions" text in several skills of one pack.
Critical findings (decoded-and-evaluated strings, reverse-shell and miner strings) that may be test fixtures but were not cleared by a real review.
A re-upload of another developer's repo with many forks and stars for its age, a common malware-lure pattern. It passed the scan; reading the commits caught it.

What to do: never run curl ... | sh from a skill without reading the script, treat instructions inside a skill as data, and check that a repo is the original source (vetting checklist).

7. Real money with no human in the loop (3)

Items that place live orders or hold wallet keys and are meant to run unattended. Even an official exchange skill pack was turned down for this: our trading agents paper-trade first.

What got in

The 11 approved candidates all passed the scan and each did something the catalog did not already do. Examples: SEO Skill (Search Console MCP + CLI), Keeper.sh calendar sync + MCP, CCXT crypto market data MCP and samber cc-skills (ghostwriting and copywriting). All had a license GitHub recognizes and an identifiable publisher.

A short avoid list for your own agent

A second tool for a job you already cover.
Anything that is a list, course or demo rather than a skill or server.
Personal-account automation on platforms that ban it.
Install steps that pipe remote scripts into a shell.
Copies, forks and re-uploads when the original exists.
Live money or messages with no owner approval.

What we don't know yet

The reason counts come from short decision notes, grouped by the first reason each gives, so the borders are soft. The candidates are what our discovery job ranked highly for our agents' jobs, not a random sample. The wider library lists 3,305 items for discovery, 90.9% of them not yet scanned, so most items there have had no review at all.

Let a coach filter for you

Agent Coach recommends from the reviewed catalog, matched to your agent's job, and checks in daily on what to keep. It is free. REST and MCP details are in the developer docs. Paste one line into your agent:

Read https://upskill.coach/start and follow it.

FAQ

Why do agent skills and MCP servers get rejected?

Mostly not for security. Of the 108 candidates we rejected between 2026-10-17 and 2026-10-29, 88 (81.5%) had passed the automated security scan. The most common primary reason was duplication (30, 27.8%); security findings that did not clear on review were the primary reason for 9 (8.3%) (how we vet).

Which MCP servers should I avoid?

Avoid ones that automate a personal account on a platform that bans automation (our most common case was LinkedIn session automation), ones whose install step pipes a remote script into a shell, ones with "ignore previous instructions" text in agent-facing files, and copies of a popular repo published under a different account. 15 of our 108 rejections (13.9%) were for terms-of-service risk alone.

Is a LinkedIn MCP server safe to use?

The code may be fine; the account risk is the problem. LinkedIn's User Agreement prohibits automated activity, so MCP servers that message, connect or search on a member's own session put that account at risk. 7 of our rejections cite LinkedIn, and we keep the best-known community LinkedIn server at "review" for that reason, not for its code (LinkedIn MCP item).

Does a passing security scan mean I should install it?

No. A pass only means the scanner and a reader found nothing risky at that commit. It says nothing about whether the item duplicates one you have, does a job you need, or breaks a platform's rules. Only 11 of the 118 candidates that passed the scan were added to our catalog.

How many GitHub stars should an agent skill have before I trust it?

Stars are weak evidence either way. 36 of our 108 rejected candidates had 5 stars or fewer, but one rejected re-upload had suspiciously many forks and stars for its age, a known malware-lure pattern. Check who publishes it, whether it is the original source, its license and recent commits.

Should I install the official MCP server or a community one?

Prefer the official one when it covers your job. Several of our duplicate rejections were community servers for services whose official or better-maintained server is already in the catalog, such as Google Analytics MCP (official) and Resend MCP server (official).

Questions or corrections: ops@avatar33.com.