!
Purpose & Capability
The skill claims to create and deploy MCP servers (including example CLI commands and Node.js/npm requirements) but is instruction-only: there is no code, no install spec, and no declared binaries. It expects a 'mcp-server' CLI that the package does not provide or install, which is inconsistent with the stated purpose.
!
Instruction Scope
SKILL.md contains open-ended instructions and example commands that assume a specific CLI and deployment flow. It does not instruct reading unrelated files or system paths, but it is vague about how the agent should obtain the required tools or API keys — giving the agent wide discretion (e.g., to download/install an unknown tool or prompt for secrets).
ℹ
Install Mechanism
There is no install spec (instruction-only), which lowers immediate disk/execution risk. However, the documentation lists Node.js and npm/yarn requirements and example CLI commands without providing an install mechanism or package source, creating ambiguity about where binaries should come from.
!
Credentials
The SKILL.md mentions 'API keys for external services (if needed)' but the skill declares no required environment variables or primary credential. A tool that deploys servers and connects to external APIs would normally declare expected credentials; the absence is inconsistent and could lead to runtime requests for secrets.
✓
Persistence & Privilege
The skill does not request always:true and has no OS restrictions or config-path writes declared. Autonomous invocation is allowed (the platform default) but does not combine here with other high-risk privileges.
What to consider before installing
This skill is inconsistent: it references a 'mcp-server' CLI, Node.js/npm requirements, and API keys but provides no code, no install instructions, and no declared credentials. Before installing or enabling it, ask the publisher for: (1) the source code or a trusted package URL (npm/GitHub release), (2) clear install instructions or a packaged installer, and (3) an explicit list of required environment variables and why they're needed. Do not provide API keys or other secrets until you verify the tool's origin and inspect its code. If you must test it, run it in an isolated environment (throwaway VM or container) and monitor network activity. If the agent starts trying to download or run an unknown 'mcp-server' binary or requests credentials, treat that as a red flag and revoke any secrets provided.
