.svg)
The main security considerations for MCP servers and agent skills are supply-chain risks: both deliver instructions and code that an AI agent trusts by default and acts on with the agent's own credentials. A team that vets each MCP server and skill like any third-party software (provenance, pinned versions, review, a pre-install scan, scoped tokens, a sandbox, an egress allowlist and logged tool calls) can adopt them at speed and still answer the customer who asks how.
At a glance
- What is being trusted: MCP servers (code that exposes tools to an agent) and agent skills (markdown instructions, often with bundled scripts, that an agent loads and follows)
- Scale of the problem: a January 2026 study of 31,132 agent skills found 26.1% with at least one vulnerability and 5.2% with high-severity patterns suggesting malicious intent (Liu et al., arXiv 2601.10338)
- Highest-risk skills: skills that bundle scripts were 2.12 times more likely to be vulnerable than instruction-only skills
- MCP specification position: tool annotations are untrusted unless they come from a trusted server, MCP servers must reject tokens issued for other services, and a local stdio server is an ordinary operating system process with no built-in sandbox
- Pre-install scanning: NVIDIA SkillSpector is an open-source static scanner for skills. A SkillSpector scan informs a human review and replaces neither the review nor runtime controls
- Security capabilities involved: third-party and supply-chain risk management, change management, secure configuration
What Are MCP Servers and Agent Skills, and Why Are They a Software Supply Chain?
MCP servers and agent skills are the two main ways teams extend an AI agent, and both are third-party software that the agent executes or obeys without a human reading each step. The Model Context Protocol (MCP) connects an agent to tools: an MCP server wraps a service such as a CRM, a database or a file system and publishes tools the agent can call. An agent skill is a folder with a markdown file of instructions, sometimes with scripts, that teaches the agent how and when to do a task.
| Component | What the agent receives | What the agent does with the component | Where teams find the component |
| MCP server | Tool names, descriptions and parameters, then tool results | Reads the descriptions as guidance, calls the tools with the agent's credentials | Package registries, GitHub, vendor connectors |
| Agent skill | Markdown instructions, sometimes scripts and reference files | Follows the instructions and runs the bundled scripts | Skill marketplaces, GitHub repositories, colleagues |
Both components travel the same route as an npm or PyPI package: a developer finds one, adds a line of configuration, and the agent starts using the component. A library is called by code a developer wrote. A skill or a tool description is read by a model that treats text as potential instructions, so every sentence in the file is an instruction the agent may carry out. The prompt injection guide explains why models cannot reliably separate instructions from data.
How Common Are Vulnerable Agent Skills? Findings From the 42,447-Skill Study
Vulnerable agent skills are common: Liu et al. crawled 42,447 skills from two skill marketplaces, analyzed 31,132 of them, and found at least one vulnerability in 26.1% (arXiv 2601.10338, January 2026).
| Agent skills study finding (Liu et al., 2026) | Result |
| Skills crawled from two marketplaces | 42,447 |
| Skills analyzed | 31,132 |
| Skills with at least one vulnerability | 26.1% |
| Skills with high-severity patterns suggesting malicious intent | 5.2% |
| Likelihood of vulnerability, script-bundling skills vs. instruction-only skills | 2.12 times higher |
| Vulnerability categories | Prompt injection, data exfiltration, privilege escalation, supply chain |
The 5.2% figure means roughly one skill in twenty showed signs of being written to harm the person who installs the skill. The 2.12 multiplier points intake reviews at the right target: a skill that bundles scripts carries executable code, and code earns a code review.
How Does a Poisoned Markdown Skill Compromise an AI Agent?
A poisoned markdown skill compromises an agent by hiding attacker instructions inside a file that looks like a helpful how-to, so the agent carries out the attack with the user's permissions. The attack takes four steps:
- Publish. The attacker posts a free skill on GitHub or a marketplace that solves a real problem for the target audience, such as formatting reports or reviewing pull requests.
- Install. A developer copies the skill into the coding agent's skills folder. Few people read the full markdown file, and fewer read the bundled scripts.
- Trigger. A routine request matches the skill's description, and the agent loads the instructions, including a planted step such as run setup.sh first or upload the environment file for debugging.
- Act. The agent runs the script or sends the data with the developer's access: SSH keys, cloud credentials, tokens in environment files, and the source code in the working directory.
The poisoned markdown skill was the attack Ali Aleali called the easiest to pull off in his prompt injection talk at the second AI Security Engineers Ottawa meetup: write a skill the victim will want, publish the skill, and wait. His question to the room was how many people read a markdown file before handing the file to their agent. The same risk appears in public registries: the OpenClaw explainer cites researchers who found hundreds of malicious skills on the ClawHub registry.
Key insight
A skill file carries the same authority as the person who installed the skill
An agent skill holds no permissions. The agent follows the skill's instructions with whatever access the agent holds, so a poisoned skill inherits the developer's credentials, files and network reach on the first run.
What Are the Security Considerations for MCP Servers?
The security considerations for MCP servers fall into five risks: poisoned tool descriptions, over-broad or forwarded tokens, ungated high-impact tools, unsandboxed local servers, and servers that change after approval. The MCP specification addresses several of these directly.
| MCP server security risk | How the risk works | What the MCP specification and good practice say |
| Tool poisoning | Tool names and descriptions go into the model's context, so a malicious description can instruct the agent to read files or call other tools | The MCP tools specification says clients must treat tool annotations as untrusted unless they come from trusted servers, and that a human should be able to deny tool invocations |
| Over-broad and forwarded tokens | A server holds a token with more scope than the task needs, or forwards a client's token to downstream APIs | The MCP security best practices call token passthrough an anti-pattern: servers must not accept tokens not issued for them |
| Ungated high-impact tools | A shell, payment or delete tool is callable with no approval step, so one injected instruction reaches the tool | Approval gates on external, financial and irreversible actions, set by the host application |
| Local server compromise | A stdio server is an ordinary operating system process with the launching user's access | The MCP local server security guidance places isolation on the host and operator: a container, sandbox or VM |
| Change after approval | A server changes the tool list or code after a user approved the server | The same MCP guidance notes that one-time consent and package pinning do not cover a server that changes later, so changes need re-review |
MaxKB shows how an ungated tool turns injection into compromise. In CVE-2026-77521, the open-source agent platform exposed an execute-shell tool to assistants without human approval. An attacker could reach the shell through chat or through an ingested document (indirect prompt injection), with root inside the official container. MaxKB fixed the flaw in version 2.10.5-lts.
The MCP authorization specification builds on OAuth 2.1, and authorization is optional in the protocol. A third-party MCP server that skips authorization, or predates the current rules, gets the same review as any vendor integration. The agentic AI security architecture guide covers the control set for the agent-to-tool connection, and the AI agent identity guide covers the scoped, short-lived credentials each agent should hold.
What Can a Pre-Install Scanner Such as NVIDIA SkillSpector Catch?
NVIDIA SkillSpector is an open-source (Apache 2.0) static scanner that checks an agent skill for risky content before installation, and SkillSpector findings are an input to human review. Help Net Security and the NVIDIA documentation describe the scanner as a pre-install check.
SkillSpector has three limits a team should plan around:
- Static analysis only. SkillSpector reads the skill and does not execute the skill, so behavior that appears only at runtime (a script that downloads a second stage, a condition that triggers on certain inputs) can pass the scan.
- No containment. SkillSpector has no role once the skill is installed. Sandboxing, egress limits and logging still carry the runtime risk.
- Human judgment required. Findings need a reviewer, and the scanner can flag benign content as risky. A finding is the start of a review, and the decision to install stays with a named person.
MCP Security Best Practices: A 10-Step Intake Checklist for MCP Servers and Agent Skills
MCP security best practices start at intake: each MCP server and agent skill passes the same checklist before any agent loads the component, and again on every update.
| Step | MCP server and agent skill intake control | Risk the control reduces |
| 1 | Provenance: record the publisher, repository, maintainer history and license. Prefer vendor-published servers and skills from known authors | Malicious or abandoned components |
| 2 | Inventory and owner: add each server and skill to the agent inventory with a named owner and the agents that use the component | Unknown components nobody patches or removes |
| 3 | Pin versions: pin to a commit hash or exact version, and block auto-update | Changes after approval |
| 4 | Read the instructions: a person reads every markdown file and tool description end to end | Planted instructions and tool poisoning |
| 5 | Review the code: review bundled scripts and server code, with extra depth for script-bundling skills | Malware and credential theft |
| 6 | Scan before install: run a static scanner such as SkillSpector and resolve each finding | Known risky content, at scale |
| 7 | Least-privilege tools and tokens: expose only the tools the task needs, with short-lived tokens issued for that server alone | Over-broad tokens, token passthrough, ungated tools |
| 8 | Sandbox: run local servers and skill scripts in a container or VM with no access to the developer's home directory or secrets | Local server compromise |
| 9 | Egress allowlist: permit outbound traffic only to the destinations the component needs | Data exfiltration |
| 10 | Log tool calls: record every tool call, parameters and result in the SIEM, and gate high-impact tools behind human approval | Undetected misuse, slow incident response |
Steps 1 to 6 decide whether a component enters the environment. Steps 7 to 10 limit what a component can do if the review missed something. The OpenClaw safe setup guide applies the runtime steps to one self-hosted agent, with exact settings.
Watch out
An MCP server or skill approved once can change on the next update
Intake review happens once, while updates arrive continuously. Pinned versions turn each update into a reviewable change, and the team decides when the supply chain changes instead of the publisher.
Which Security Capabilities Cover MCP and Agent Skills Security?
MCP and agent skills security belongs to three existing security capabilities: third-party and supply-chain risk management, change management, and secure configuration. A team that already runs these capabilities for libraries and SaaS vendors extends the same processes to AI components.
| Security capability | What the capability adds for MCP servers and agent skills |
| Third-party and supply-chain risk management | Provenance checks, inventory, owners and a defined intake review for every server and skill |
| Change management | Pinned versions, review of every update, and a record of who approved which version |
| Secure configuration | Least-privilege tools and tokens, sandboxed execution, egress allowlists and approval gates |
A capability assessment shows where each of these capabilities stands today. We often see AI components bypass a working vendor review process, because a developer adds an MCP server through a configuration file instead of a purchase request. The fix is to route MCP servers and skills into the intake the company already has, then document the rule in the Security Program Manual and the supplier policy.
How Does MCP and Agent Skills Security Affect Security Questionnaires and AI Certifications?
MCP and agent skills security now appears in enterprise security questionnaires, and a documented intake process answers the questions with evidence. Buyers ask which third-party AI components an agent uses, how they are vetted, and how a compromise would be detected. A vendor with an inventory, pinned versions, review records and tool-call logs answers in a day. A vendor without them stalls the deal while the team reconstructs what the developers installed.
The same records serve AI certifications. AIUC-1 requires vendor and model due diligence (E006), and ISO/IEC 42001 Annex A covers third-party relationships (A.10). Intake reviews, approval records and update reviews are the evidence both ask for, produced as a byproduct of the security work.
Why MCP Servers and Agent Skills Deserve the Same Scrutiny as Production Code
MCP servers and agent skills give agents real reach, and a component the agent trusts by default is a component an attacker wants to write. The controls are familiar ones: know the publisher, pin the version, read the file, scan the code, scope the token, contain the process and log the action. Teams that apply them at intake add AI capabilities faster, because each new server or skill follows a process the security team and the customer already trust.
If your agents are loading MCP servers and skills faster than anyone can review them, Truvo builds the intake process, the runtime controls and the evidence your customers request, and AI penetration testing checks whether a poisoned skill or tool description can reach your data. Book a strategy call.
Vet every MCP server and skill
Bring MCP servers and agent skills into an effective security program before agents load them.
Related reading: ISO 42001 vs AIUC-1 vs NIST AI RMF; AI-specific risks under ISO 42001.
Frequently Asked Questions About MCP and Agent Skills Security
What are the main security considerations for MCP?
The main security considerations for MCP are poisoned tool descriptions, over-broad or forwarded tokens, high-impact tools without approval gates, local servers running with full user access, and servers that change after approval. Each MCP server needs provenance checks, pinned versions, scoped tokens, a sandbox, egress limits and logged tool calls.
Are agent skills safe to install?
Agent skills can be installed safely after review. A January 2026 study of 31,132 skills found 26.1% with at least one vulnerability and 5.2% with signs of malicious intent. Read the markdown, review bundled scripts, scan before install, and run the agent in a sandbox with an egress allowlist.
What is tool poisoning in MCP?
Tool poisoning is a prompt injection attack where an MCP server's tool names or descriptions contain hidden instructions. The model reads tool descriptions as context, so a malicious description can steer the agent to read files or call other tools. The MCP specification tells clients to treat tool annotations from untrusted servers as untrusted.
What is NVIDIA SkillSpector?
NVIDIA SkillSpector is an open-source static scanner that checks agent skills for risky content before installation. SkillSpector does not run the skill or contain runtime behavior, and findings need human review. Teams pair SkillSpector with sandboxing, egress limits and tool-call logging.
Does the MCP specification require authorization?
Authorization is optional in the MCP specification. When an MCP server implements authorization, the specification builds on OAuth 2.1 and forbids accepting tokens issued for other services. Many third-party servers predate the current rules, so each server needs the same review as a vendor integration.
How do customers ask about MCP and agent skills in security questionnaires?
Enterprise buyers ask which third-party AI components a vendor's agents use, how those components are vetted, and how a compromised component would be detected. An inventory, pinned versions, intake review records and tool-call logs answer these questions and double as evidence for AIUC-1 and ISO 42001.
Ready to Start Your Compliance Journey?
Get a clear, actionable roadmap with our readiness assessment.
Contact Us
Sample SOC 2 Control List
Input your email to download the list.
About the Author
Former security architect for Bank of Canada and Payments Canada. 20+ years building compliance programs for critical infrastructure.