MCP.Market

Is Skillsmith MCP server safe?

Yes, with the usual care.

B72/100grade B

Safe to use. Minor gaps such as a missing repository or slower maintenance.

What to know before installing
  • highShell command built from a string (injection risk)

How Skillsmith compares

Against every graded AI and agents MCP server, from our own scans and uptime checks. Updated after each scan run.

Safety score
72/100
higher than 40% of 4,460 AI and agents servers
Tools that change things
9%
typical: 0%. Fewer write tools means less an agent can break

What its tools let an agent do: 35 read · 3 change · 2 send or post · 4 run or deploy

Release history: 4 versions in the registry since 2026-09-13, latest 2026-10-12, typically one every 7 days.

Public scan report

scanner v0.1.10 · 2026-10-15 · same rubric, same numbers if you re-run it

1 high
  • Code scan638 source files scanned13/25
  • –Live reliabilityno gateway calls yet and no remote to proben/a
  • –Tool poisoningtools not inspected (local package is not executed); not countedn/a
  • Auth qualitylocal package, no credentials required12/15
  • Maintenancelast push 1 days ago15/15
  • Maintainer identityregistry namespace matches repository owner7/10

Findings (1)

  • highShell command built from a string (injection risk)exec.shell-concat
    dist/src/index.startup-helpers.js: …'win32' ? 'start' : 'xdg-open'; exec(`${cmd} "${userGuidePath}"`); console.log(`…
Overall 72/100. Components that don't apply are left out of the denominator. Any critical finding is an F.RubricAppeal a findingJSON

Other servers that do what Skillsmith does

  • LLM Sandbox
    Securely run LLM-generated code in isolated containers across 7 languages and 3 container backends.
    A
  • Pm Claude Skills
    1310 professional Agent Skills + workflow recipes — searchable & fetchable over MCP.
    A
  • Watch Skill
    Watch video and live sessions, keep timestamped evidence, and verify an agent's own work.
    B

Skillsmith reviews, tools and install