mcp-security-audit

Audit MCP (Model Context Protocol) server configurations for security issues. Use this skill when: - Reviewing .mcp.json files for security risks - Checking MCP server args for hardcoded secrets or shell injection patterns - Validating that MCP package-runner dependencies use exact reviewed versions, not bare names, @latest, or ranges - Detecting mutable npm/npx, bunx, pnpm dlx, yarn dlx, and npm exec references in MCP configurations - Auditing which MCP servers a project registers and whether they're on an approved list - Checking for environment variable usage vs. hardcoded credentials in MCP configs - Any request like "is my MCP config secure?", "audit my MCP servers", or "check .mcp.json" keywords: [mcp, security, audit, secrets, shell-injection, supply-chain, governance]

Agent Skill from github/awesome-copilot

Copilot Studio

Passes documented load rules

No documented load rule failed.

Warnings (don't change the verdict):

Warning: Description is a single line (CS-DESC-ONELINE)
description spans more than one line
rule · Copilot Studio: Troubleshoot skills that don't load

Microsoft 365 Copilot Preview, Frontier tenants only

Passes documented load rules

No documented load rule failed.

An agent can have at most 8 skills. Custom skills aren't available in tenants that use Microsoft Purview Information Barriers.

Compatible isn't the same as safe. These verdicts only say whether a skill's files follow Microsoft's documented load rules. The checker reads files and never runs them, and it doesn't review what a skill or its scripts actually do. Read a skill's instructions and scripts before you add it to an agent.

Standards signals

Meets the agentskills.io required fields.

Frontmatter	Present and parsed Spec: frontmatter
name	Meets the spec (1-64 chars, a-z 0-9 hyphens) Spec: name
description	Present, 1-1,024 characters Spec: description
compatibility	Absent or under 500 characters Spec: compatibility
Name matches folder	Yes (`mcp-security-audit`) Spec: name

Observed from the public SKILL.md at the commit above on 2026-10-23. Not a certification: AAIF and the Agent Skills project don't certify skills. Validate your own skill with skills-ref validate.

Source repo	github/awesome-copilot
Path	skills/mcp-security-audit/SKILL.md
Commit checked	`d85f762d6e52`
Repo license	MIT
Files	1
Scripts	None
Instructions	11,580 characters
Deepest folder	0 below the skill folder
Rules version	2026-10-22

Re-check the latest version How skill checks work

Is this wrong or out of date? Email us. Skills data built 2026-10-23; rules as of 2026-10-22.

Rule-based checks of public files against Microsoft's documented load rules, not tested in Copilot Studio or Microsoft 365 Copilot. Independent project, not affiliated with Microsoft.