mcp-builder

This appears to be a legitimate MCP server development guide, but take these cautions before installing or letting an agent use it: - Verify remote URLs: the SKILL.md instructs the agent to fetch resources from modelcontextprotocol.io and raw.githubusercontent.com. Confirm those domains and the specific files are official and safe to fetch. Prefer well-known release pages or repository tags when possible. - Missing local files: the guide references ./reference/*.md and LICENSE.txt, but the skill package contains only SKILL.md. Decide whether those local docs should be present; absent files may cause the agent to search the web or behave unpredictably. - Limit web access when testing: because the guide relies on WebFetch/web search, run it in a controlled environment or sandbox first to observe what external content is retrieved. - Do not provide credentials: the guide asks you to study API docs exhaustively but does not require credentials. Never paste API keys or secrets into prompts or fetched documents unless you explicitly trust and control the endpoint. - Review fetched content before allowing agent-driven automation: fetched raw files (especially raw GitHub content) are arbitrary text and could include instructions or links you do not want executed. If you want a safer install, ask the skill author to include the referenced reference/*.md files and LICENSE.txt in the package or to replace remote URLs with canonical, versioned release links.