Atlas / MCP servers / fkesheh / Skill

SkillSAFE

Name: Skill
Author: fkesheh

mcp/fkesheh/skill

MCP server by fkesheh · ai · claude skills · llm · Audited 2026-10-08

LLM-managed skills platform using MCP - create, edit, and execute skills programmatically in Claude, Cursor, and any MCP-compatible client without manual file uploads.

Verdict

SAFE

Grade

Trust score

89 /100

Exposed tools

5 3r · 2w · 0d

Transport

stdio

License

MIT

Stars

Overview

From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.

A Model Context Protocol (MCP) server that enables Claude to manage skills stored in ~/.skill-mcp/skills. This system allows Claude to create, edit, run, and manage skills programmatically, including execution of skill scripts with environment variables.

Quick Status

Status: ✅ Production Ready Test Coverage: 86% (145/145 tests passing) Deployed: October 18, 2025 Architecture: 22-module modular Python package with unified CRUD architecture

Overview

TL;DR: Write Python code that unifies multiple skills in one execution - follows Anthropic's MCP pattern for 98.7% more efficient agents.

This project consists of two main components:

MCP Server (src/skill_mcp/server.py) - A Python package providing 5 unified CRUD tools for skill management
Skills Directory (~/.skill-mcp/skills/) - Where you store and manage your skills

Key Advantages

🚀 Unified Multi-Skill Execution (Code Execution with MCP)

Build once, compose everywhere - Execute Python code that seamlessly combines multiple skills in a single run:

# One execution, multiple skills unified!
# Imports from calculator, data-processor, and weather skills
from math_utils import calculate_average          # calculator skill
from json_fetcher import fetch_json                # data-processor skill
from weather_api import get_forecast               # weather skill

# Fetch weather data
weather = fetch_json('https://api.weather.com/cities')

# Calculate averages using calculator utilities
temps = [city['temp'] for city in weather['cities']]
avg_temp = calculate_average(temps)

# Get detailed forecast
forecast = get_forecast('London')
print(f"Average temperature: {avg_temp}°F")
print(f"London forecast: {forecast}")

What makes this powerful:

✅ Context-efficient - Dependencies and env vars auto-aggregated from all referenced skills
✅ **Composable

Read from source at commit fa65cf7a0c22OBSERVED · 2026-10-08

Connect

Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control. Replace the environment placeholders with a token scoped to the least it needs.

claude-code

claude mcp add skill-mcp --env API_KEY=${API_KEY} -- uvx skill-mcp

claude-desktop

{
  "mcpServers": {
    "skill-mcp": {
      "command": "uvx",
      "args": [
        "skill-mcp"
      ],
      "env": {
        "API_KEY": "${API_KEY}"
      }
    }
  }
}

Exposed tools (5)

3 read · 2 write · 0 destructive.

Tool	Risk	Description
`execute_python_code`	write
`run_skill_script`	write
`skill_crud`	read
`skill_env_crud`	read
`skill_files_crud`	read

Trust audit

SAFEgrade B · trust 89/100 Nothing in the source contradicts what it says it does. Grade A is reserved for packages that have also passed the behavioural sandbox.

Layer	What it checks	Result
L0	Provenance & inventory	PASS
L1	Static analysis of the code	PASS
L2	Instruction surface (what it tells the agent)	PASS
L3	Class-specific surface	PASS
L4	Behavioural (sandbox)	SKIPPED

What the source does

Filesystem: declared (1 observation(s))
Network: declared (1 observation(s))
Shell: none-observed
Dependencies: pinned
Secrets in source: none-found

Findings (12)

LOWInventory / provenance · inv.hidden_file · CWE-1104

.pre-commit-config.yaml

.pre-commit-config.yaml

Why it matters. hidden member outside the usual dotfiles

Fix. review its purpose

LOWInformation disclosure · disclose.log_secret · CWE-209, CWE-532

tests/test_script_service.py:330

print(f"API_KEY: {api_key}")

LOWFilesystem / path · fs.traversal · CWE-22, CWE-59

tests/test_path_utils.py:37

validate_path(skill_name, "../../../etc/passwd")

LOWFilesystem / path · fs.traversal · CWE-22, CWE-59

tests/test_script_service.py:52

await ScriptService.run_script("test-skill", "../../etc/passwd")

LOWFilesystem / path · fs.traversal · CWE-22, CWE-59

tests/test_script_service.py:81

"test-skill", "scripts/test.py", working_dir="../../etc"

INFOPrompt injection · prompt.authority_framing · CWE-94, CWE-1427

README.md:884

6. **Run with minimal permissions** - Don't run skills as root or with elevated privileges