What is the risk of installing a skill or MCP server from a stranger?

Answer

They carry different risks and both are underestimated.

An MCP server is code. Installing one via npx or uvx runs arbitrary code on your machine with your user's privileges. It can read your SSH keys, your environment variables, your browser profile, and your source. This is the same risk as any dependency, except people install servers more casually than they add a package, and often from individuals rather than organisations.

A skill is instructions the agent will follow. No code executes on installation, but the agent reads it and acts on it. A malicious SKILL.md can instruct the agent to exfiltrate files, insert a subtle backdoor, or send data to an endpoint, all while appearing to do its stated job. Because the agent has your tool permissions, the skill inherits them indirectly.

The skill case is the less obvious one and arguably the more insidious, because reviewing a markdown file feels safe in a way that reviewing a package does not.

What to check before installing either:

• Who publishes it, and whether they are accountable
• Read the source. For a skill this is quick, and it is the whole file.
• Anything instructing the agent to fetch a URL, run a command, encode data, or contact an endpoint
• What credentials it asks for and why it needs that scope
• Whether it is maintained, and whether the repository is real rather than a fresh account

For an ecosystem, the useful controls are provenance, review, and a security scan step before listing. Any directory accepting community submissions inherits a duty to scan, because the entries it lists are executable in effect.

Common wrong answer

"It is only a markdown file, so it cannot do anything." The file does not execute, and the agent does. Instructions handed to a system with tool access are a code path, and treating them as inert documentation is the mistake this attack relies on.