mcps

The skill allows adding and executing arbitrary MCP servers with user-controlled commands and arguments. Users can configure servers to run any command (uvx, npx, or arbitrary binaries) with any arguments, creating a vector for tool exploitation. While this is the intended functionality of an MCP manager, it enables execution of untrusted code without validation or sandboxing. The skill provides no warnings about security implications of adding untrusted MCP servers.

SKILL.md

mcps add fetch --command uvx --args mcp-server-fetch
mcps add postgres --command npx --args @modelcontextprotocol/server-postgres
mcps add remote --type sse --url http://localhost:8000/sse

The skill demonstrates passing sensitive credentials via environment variables (POSTGRES_CONNECTION_STRING, GITLAB_PERSONAL_ACCESS_TOKEN) to MCP servers. While using environment variables is better than hardcoding, the configuration examples show these being stored in ~/.mcps/mcp.json with ${VAR_NAME} references. If users misconfigure this or the mcps tool doesn't properly handle variable expansion, credentials could be exposed in plaintext configuration files or logs.

SKILL.md

"env": {
  "POSTGRES_CONNECTION_STRING": "${DATABASE_URL}",
  "GITLAB_PERSONAL_ACCESS_TOKEN": "${GITLAB_TOKEN}"
}

The skill supports adding remote MCP servers via SSE and HTTP protocols (--type sse/http with --url). This allows connecting to arbitrary network endpoints without authentication validation or security warnings. Malicious or compromised remote servers could exploit the agent through tool responses, inject malicious content, or exfiltrate data through tool invocations.

SKILL.md

mcps add remote --type sse --url http://localhost:8000/sse
mcps add http-server --type http --url http://localhost:8000/mcp