Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add yeaight7/agent-powerups --skill mcp-risk-reviewgit clone --depth 1 https://github.com/yeaight7/agent-powerupsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/yeaight7/agent-powerups/mcp-risk-review)<a href="https://agentmods.dev/skills/yeaight7/agent-powerups/mcp-risk-review"><img src="https://agentmods.dev/badge/skills/yeaight7/agent-powerups/mcp-risk-review/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/yeaight7/agent-powerups/mcp-risk-review"><img src="https://agentmods.dev/badge/skills/yeaight7/agent-powerups/mcp-risk-review.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00057 | $0.00758 |
| Opus 5.5 | $0.00023 | $0.00303 |
| Sonnet 5.5 | $0.00011 | $0.00152 |
| Haiku 4.5 | $0.00006 | $0.00076 |
Grade A, and why
mcp-risk-review scanned grade A with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
rg -n 'npx -y|@latest|curl .*\| *sh' <config-file> How it starts
The opening of the file, as written. The whole thing — 71 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Purpose
Triage the risk of an MCP server before it gains access to the session. An enabled server's tools execute with real filesystem, network, and credential reach; the review happens before enablement, not after the first incident.
When to Use
- A staged MCP server config is a candidate for enabling
- A third-party MCP server is proposed from outside the repo
- An existing server entry changes transport, credentials, or tool surface
- A long-enabled server is due a periodic re-review
For filesystem-server path boundaries in depth, continue with the filesystem-mcp-guardrails skill after this triage.
Inputs
- The server config entry: command, args, env, transport
- The server's declared tool list (from its manifest or a smoke run)
- What the session can reach if the server misbehaves
Workflow
-
Launch vector. Pinned, locally installed binaries beat remote latest-version execution:
rg -n 'npx -y|@latest|curl .*\| *sh' <config-file>Unpinned remote execution is a P1 by default — the server reviewed today is not necessarily the server that runs tomorrow.
-
Transport and exposure. A local stdio process is the conservative default. Network transports must answer: who can connect, is it loopback-only, is there authentication.
-
Credentials and environment. Hardcoded secrets in the config are P0. Environment pass-through should name specific variables — never forward the whole environment.
-
Tool surface. Enumerate the tools the server actually declares. Write, exec, and delete capabilities raise the bar; a read-only server with three tools is a different risk class from a shell-capable one with thirty.
-
Scope boundaries. Paths bounded to the workspace, method filtering configured, timeouts set.
-
Repo-native checks, then approval. For staged Agent Powerups configs, run the availability checks, then stop for explicit user approval before enabling:
apx mcp check <name> apx mcp smoke <name>
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago First seen · 71 lines · 57 tokens per session scan A 664e6db81001
mcp-risk-review is a skill published in the GitHub repository yeaight7/agent-powerups (6 stars, last pushed 19d ago), licensed Apache-2.0. It adds 57 tokens to every session and 758 once invoked, about $0.0002 per session on Opus 5.5. A static security scan graded it A with 1 finding (makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-14.
Other skills, from other repositories
skill-authoring
Author SKILL.md: frontmatter, structure, writing principles.
systematic-debugging
4-phase root cause debugging: understand bugs before fixing.
github-code-review
Review PRs: diffs, inline comments via gh or REST.
requesting-code-review
Pre-commit review: security scan, quality gates, auto-fix.
simplify-code
Sequential 3-lens cleanup of recent code changes.
test-driven-development
TDD: enforce RED-GREEN-REFACTOR, tests before code.