How do I install the MCP Vulnerabilities skill?

Run npx skillmds@latest add aibot88/mcp-vulnerabilities in your terminal (requires Node.js), paste this page's agent-chat prompt into Claude, Cursor, or any MCP-connected agent, or download the SKILL.md file and copy it into your agent's skills directory.

Is MCP Vulnerabilities safe to use?

This skill has not completed SkillMD's automated safety review yet. Independent scanners report: SkillSpector: CAUTION, Skill Scanner: PASS. Capability flags: reads secrets. SkillMD never runs a skill's scripts for you; review the SKILL.md before installing.

Which AI agents work with MCP Vulnerabilities?

This skill is tagged as working with Claude Code, Claude.ai, OpenAI Codex. SKILL.md is an open format, so most agents that read a skills directory can load it too.

Is MCP Vulnerabilities free to use?

Yes. Installing skills from SkillMD is free. This skill is licensed under MIT.

Who published MCP Vulnerabilities?

aibot88 (@aibot88) published this skill. Their other Agent Skills are listed on their SkillMD profile.

MCP Vulnerabilities by aibot88 — Agent Skill

Name: MCP Vulnerabilities
Rating: 4.666666666666667 (3 reviews)
Author: aibot88

File contents

MCP Vulnerabilities — Skill Entry

This SKILL.md is the entrypoint for the MCP Vulnerabilities skill.

The skill encodes the OWASP MCP Top 10 (2025) as structured, machine-readable references that an agent can query to identify, assess, and remediate MCP security risks.

Normative references (MCP Top 10)

00 Vulnerability Index
01 Token Mismanagement and Secret Exposure
02 Privilege Escalation via Scope Creep
03 Tool Poisoning
04 Software Supply Chain Attacks and Dependency Tampering
05 Command Injection and Execution
06 Prompt Injection via Contextual Payloads
07 Insufficient Authentication and Authorization
08 Lack of Audit and Telemetry
09 Shadow MCP Servers
10 Context Injection and Over-Sharing

Skill layout

SKILL.md — this file (skill entrypoint).
references/ — the MCP Top 10 normative documents.
- 00-vulnerability-index.md — master index of all vulnerability identifiers, severities, and cross-references.
- 01 through 10 — one document per vulnerability aligned with OWASP MCP numbering.
assets/ — reusable format and constants blocks.
- constants/ — vulnerability catalog and severity definitions.
  - constants-mcp-catalog-v1.0.0.md
- formats/ — output contract examples.
  - format-vulnerability-assessment-v1.0.0.md
  - format-remediation-checklist-v1.0.0.md

---name: mcp-vulnerabilitiesdescription: OWASP MCP Top 10 vulnerability knowledge base for identifying, assessing, and remediating security risks in Model Context Protocol environments.license: MIT--- # MCP Vulnerabilities — Skill Entry This `SKILL.md` is the **entrypoint** for the MCP Vulnerabilities skill. The skill encodes the **OWASP MCP Top 10 (2025)** as structured, machine-readable references that an agent can query to identify, assess, and remediate MCP security risks. ## Normative references (MCP Top 10) 1. [00 Vulnerability Index](references/00-vulnerability-index.md) 2. [01 Token Mismanagement and Secret Exposure](references/01-token-mismanagement-secret-exposure.md) 3. [02 Privilege Escalation via Scope Creep](references/02-privilege-escalation-scope-creep.md) 4. [03 Tool Poisoning](references/03-tool-poisoning.md) 5. [04 Software Supply Chain Attacks and Dependency Tampering](references/04-supply-chain-attacks-dependency-tampering.md) 6. [05 Command Injection and Execution](references/05-command-injection-execution.md) 7. [06 Prompt Injection via Contextual Payloads](references/06-prompt-injection-contextual-payloads.md) 8. [07 Insufficient Authentication and Authorization](references/07-insufficient-authentication-authorization.md) 9. [08 Lack of Audit and Telemetry](references/08-lack-of-audit-telemetry.md) 10. [09 Shadow MCP Servers](references/09-shadow-mcp-servers.md) 11. [10 Context Injection and Over-Sharing](references/10-context-injection-over-sharing.md) ## Skill layout - `SKILL.md` — this file (skill entrypoint). - `references/` — the MCP Top 10 normative documents. - `00-vulnerability-index.md` — master index of all vulnerability identifiers, severities, and cross-references. - `01` through `10` — one document per vulnerability aligned with OWASP MCP numbering. - `assets/` — reusable format and constants blocks. - `constants/` — vulnerability catalog and severity definitions. - `constants-mcp-catalog-v1.0.0.md` - `formats/` — output contract examples. - `format-vulnerability-assessment-v1.0.0.md` - `format-remediation-checklist-v1.0.0.md`

Frequently asked questions

MCP Vulnerabilities