Borrowing it
Nothing to install: this file belongs to docdyhr/simplenote-mcp-server. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.
curl -O https://raw.githubusercontent.com/docdyhr/simplenote-mcp-server/main/.claude/skills/mcp-implementation-security-review/SKILL.mdgit clone --depth 1 https://github.com/docdyhr/simplenote-mcp-serverWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/docdyhr/simplenote-mcp-server/mcp-implementation-security-review)<a href="https://agentmods.dev/skills/docdyhr/simplenote-mcp-server/mcp-implementation-security-review"><img src="https://agentmods.dev/badge/skills/docdyhr/simplenote-mcp-server/mcp-implementation-security-review/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/docdyhr/simplenote-mcp-server/mcp-implementation-security-review"><img src="https://agentmods.dev/badge/skills/docdyhr/simplenote-mcp-server/mcp-implementation-security-review.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00200 | $0.04800 |
| Opus 5.5 | $0.00080 | $0.01920 |
| Sonnet 5.5 | $0.00040 | $0.00960 |
| Haiku 4.5 | $0.00020 | $0.00480 |
Grade D, and why
mcp-implementation-security-review scanned grade D with 5 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured yesterday.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Encoded or obfuscated payloadmediumSupply chain
base64 or hex that is decoded and executed hides what actually runs from anyone reading the file.
| Dynamic code evaluation | `eval(args.expression)`, `exec(tool_output)`, `new Function(args.code)()` | Sandboxed parser, AST-based evaluation, or predefined allowlist | `__import__('os').system('whoami')`, `require('chi Downgraded: this mod is about security review, or the phrase is quoted, so it is likely naming the pattern rather than instructing it.
Cloud metadata endpointmediumServer-side request forgery
One request to 169.254.169.254 can return temporary IAM credentials.
| SSRF | `requests.get(user_param)`, `fetch(user_input)`, `HttpClient.GetAsync(user_input)` | Allowlist schemes/domains, block RFC1918 and link-local targets, validate URLs before sending | `http://169.254.169.254/latest Downgraded: this mod is about security review, or the phrase is quoted, so it is likely naming the pattern rather than instructing it.
Recursive force deletemediumDestructive command
rm -rf with a variable or a broad path is one typo away from removing the wrong tree.
| Command injection | `exec("convert " + args.filename)`, `os.system(f"process {user_input}")`, `Process.Start("cmd", "/c " + toolArg)` | `execFile("convert", [args.filename])`, `subprocess.run(["process", user_input], s Downgraded: this mod is about security review, or the phrase is quoted, so it is likely naming the pattern rather than instructing it.
Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
| Command injection | `exec("convert " + args.filename)`, `os.system(f"process {user_input}")`, `Process.Start("cmd", "/c " + toolArg)` | `execFile("convert", [args.filename])`, `subprocess.run(["process", user_input], s Runs shell commandslowCapability
Expected in a hook, worth knowing in a rule or an instructions file.
| Command injection | `exec("convert " + args.filename)`, `os.system(f"process {user_input}")`, `Process.Start("cmd", "/c " + toolArg)` | `execFile("convert", [args.filename])`, `subprocess.run(["process", user_input], s This is a copy
100% identical to mcp-implementation-security-review — 0 lines differ, which has more behind it and is treated as the original. This page carries a canonical link to it rather than competing with it.
How it starts
The opening of the file, as written. The whole thing — 316 lines — stays where its author put it; the contents beside it link to each section on GitHub.
MCP Implementation Security Review
Process
Step 1 — Classify the target
- Check MCP protocol version 2025-03-26 or later (current: 2025-11-25). Flag older versions as a finding but continue the review.
- Determine whether the target is a server or client.
- Classify transport as network-exposed or local-only using the transport reference below.
- Record transport, protocol version, and whether sessions exist.
Completion criterion: Target type, protocol status, and transport are identified.
Step 2 — Filter false positives
- Apply the False Positive Filters before opening findings.
- Keep docs only when they describe the repo's own server behavior, deployment, transport, or auth posture.
- For framework/SDK repositories, scope findings to the default configuration and public API surface.
Completion criterion: Remaining evidence is in-scope code, repo-owned docs, or public API behavior.
Step 3 — Check baseline controls
- For network-exposed servers, check MCP-01 through MCP-05.
- For local/STDIO servers, do not mark baseline controls PASS/FAIL; give best-practice notes and continue to RCE review.
- For clients, only review token/session handling explicitly visible in client code; do not apply the server baseline unless the user asks for client-side risk review.
Completion criterion: Each applicable control has a supported status.
Step 4 — Check RCE vectors
- Review all 7 RCE vectors.
- Mark each vector SAFE, AT RISK, or N/A.
- Prefer direct evidence over inference; the RCE Vectors table below enumerates the patterns to look for.
Completion criterion: Every relevant tool has an RCE result or explicit N/A.
Step 5 — Check OWASP MCP Top 10
- Evaluate all 10 OWASP risks below.
- If a control from Step 3 already fully covers an OWASP risk, reference that result rather than re-checking.
- For local/STDIO servers, mark network-dependent OWASP risks (MCP07, MCP09) as N/A.
- Mark each risk PASS, FAIL, or NEEDS INVESTIGATION.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- yesterday First seen · 316 lines · 200 tokens per session scan D 8974ffc89746
mcp-implementation-security-review is a skill published in the GitHub repository docdyhr/simplenote-mcp-server (21 stars, last pushed today), licensed MIT. It adds 200 tokens to every session and 4,800 once invoked, about $0.0008 per session on Opus 5.5. A static security scan graded it D with 5 findings (encoded or obfuscated payload, cloud metadata endpoint, recursive force delete). It is 100% identical to mcp-implementation-security-review, differing in 0 lines, and is treated as a copy.
Other skills, from other repositories
api-integration-architect
Design, implement, debug, and optimize API integrations with expert-level patterns for REST, GraphQL, webhooks, and authentication flows.
authentication-patterns
Authentication patterns: session vs JWT vs OAuth comparison, provider selection (NextAuth, Clerk, Supabase Auth), security checklist, and common mistakes. Use when implementing auth, reviewing auth flows, or choosing auth providers.
api-shape-explorer
Generate multiple radically different interface designs for a module using parallel sub-agents. Use when user wants to design an API, explore interface options, compare module shapes, or mentions "design it twice".
offensive-api-abuse
Advanced API exploitation methodology focused on business logic abuse and sophisticated attack patterns that bypass traditional security controls. Covers business logic bypass through API call chaining and workflow manipulation. Addresses GraphQL-specific attacks including batching for credential brute-force, query…
fastcrud
Use when building or modifying CRUD endpoints with FastCRUD (the fastcrud PyPI package) in a FastAPI project — covers FastCRUD, crudrouter, EndpointCreator, FilterConfig, JoinConfig, auto-relationship detection, the filter operator syntax (gte, in, ilike, etc.), cursor pagination, soft delete, and how to avoid N+1…
api-testing-patterns
Comprehensive API testing patterns including contract testing, REST/GraphQL testing, and integration testing. Use when testing APIs or designing API test strategies.