25 advanced engineering agent skills and plugins for Claude Code, Codex, Gemini CLI, Cursor, OpenClaw. Agent design, RAG, MCP servers, CI/CD, database design...

What to consider before installing: - Source trust: the registry shows 'source: unknown' and no homepage; prefer skills with a verifiable repository or author. The bundle’s plugin.json mentions a GitHub repo, but confirm that URL and the repository contents yourself. - Prompt-injection: the top-level SKILL.md contains phrases that look like prompt-injection (e.g., 'ignore-previous-instructions', 'you-are-now'). These can make an agent change behavior unexpectedly. Open and read the SKILL.md and remove or neutralize any such directives before granting automated invocation. - Remote fetches: the Quick Start suggests running an npx command which will fetch and execute remote installer code. Only run that if you trust the external package and have inspected it (or run in an isolated sandbox/container). - Local script execution: many bundled Python scripts read and analyze local repositories (Terraform, CI config, etc.). Review the specific scripts you intend to run; run them in a sandbox or with non-privileged user accounts first. Don't run them as root or with credentials mounted into the execution environment. - Sample secrets: demo files include example hardcoded keys/passwords for testing — treat them as test data and ensure they are not accidentally committed or used in production. - If you want lower risk: (1) manually extract only the sub-skill SKILL.md and code you need and inspect it, (2) run analyses on a copy of your codebase in an isolated environment, and (3) disable autonomous invocation for this skill until you have fully reviewed it. If you want, I can: (a) list the specific SKILL.md files that contain the suspicious prompt-injection phrases, (b) pull out and summarize the Python scripts that execute system I/O or network calls, or (c) produce a short checklist you can use to safely test this skill in a sandbox.

Package: (mcp) Version: Description: The provided source code for the 'mcp' package is a comprehensive suite of engineering utilities and 'skills' designed for AI agents and developers. The package includes modules for multi-agent collaboration (agenthub), autonomous optimization experiments (autoresearch-agent), database schema analysis and migration, API linting, CI/CD pipeline generation, and security auditing of other agent skills. While the package makes extensive use of Python's subprocess module with shell=True, this is a functional requirement for its purpose as a developer tool intended to execute user-configured build, test, and benchmark commands. The code demonstrates legitimate developer workflows, such as managing git worktrees, syncing local environment files for development, and generating operational runbooks. There is no evidence of malicious intent, credential exfiltration, or unauthorized remote payload execution. Notably, the package includes its own security auditor script designed to detect the very types of malicious patterns (e.g., command injection, credential harvesting) that security analysts look for, further indicating its legitimate nature as a productivity and safety tool.