github-mpc

This skill mainly guides MCP configuration and is not obviously malicious, but it does ask you to read local Cursor config directories and to create/use sensitive tokens (GitHub PAT, Figma token, Elasticsearch credentials). Before installing or following its steps: - Confirm the skill's provenance (unknown owner). Prefer official/internal docs or verified packages for your organization. - Do not run recommended npx commands (e.g., "npx -y @modelcontextprotocol/server-github") without auditing the npm package. Consider installing from an approved release or inspecting the package source first. - Use least-privilege tokens: create PATs with minimal scopes, prefer short-lived tokens or org-approved app installations instead of user PATs when possible. - Review the referenced config path (~/.cursor/...) and back up any sensitive files before allowing the agent to inspect them. Consider performing checks on an isolated machine/account if you have sensitive workspace access (e.g., trading212). - If you need automated checks, restrict the agent's actions (do not allow autonomous invocation) until you can validate the skill and its external dependencies. If you want, I can: list specific places in SKILL.md that read local files or ask for tokens, suggest safer alternatives (OAuth app vs PAT), or check the npm package mentioned for known issues.