SkillSpector · fastmcp

Without declared permissions the skill's intent is opaque and cannot be validated.

SKILL.md

pip install without ==version installs the latest release, which could include malicious changes.

SKILL.md

pip install without ==version installs the latest release, which could include malicious changes.

SKILL.md

pip install without ==version installs the latest release, which could include malicious changes.

references/fastmcp-cli.md

pip install without ==version installs the latest release, which could include malicious changes.

references/fastmcp-cli.md

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

SKILL.md

Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.

scripts/scaffold_fastmcp.py