mcp-developer

[Skill Scanner] Skill instructions include directives to hide actions from user The skill description appears internally coherent and proportionate to its stated purpose of guiding MCP server/client development and secure integrations. It does not present actionable code, hidden data flows, or credential handling that would raise immediate supply-chain or data-exfiltration concerns. Given the absence of actual install sources or executable behavior, the risk is Low to Moderate (principally related to the potential for over-permissive designs in practice rather than explicit malicious intent in this fragment). LLM verification: The supplied document is a high-level MCP developer skill/specification with no direct executable or obfuscated code and no hard-coded secrets. It is not itself malicious. However, it describes powerful capabilities (exposing local resources, routing agent actions, handling credentials) without enforcing mandatory, safe defaults. The static scanner finding about hiding actions increases concern about potential opacity if implementers follow non-transparent patterns. Treat this as a design-level