Review an MCP server for common security gaps: LLM-facing surfaces as injection vector (tools, resources, prompts, descriptions), scope blast radius, destructive ops without consent, upstream auth shape, input sinks (URL / path / roots / shell / schema strictness / ReDoS), tenant isolation, leakage through errors and telemetry, unbounded resources, and HTTP-mode deployment surface. Use before a release, after a batch of handler changes, or when the user asks for a security review, audit, or hardening pass. Produces grouped findings and a numbered options list.
How to install security-pass?
cyanheads/obsidian-mcp-server/security-pass
$npx -y skills add cyanheads/obsidian-mcp-server --skill security-passInstalls into the current project.
›Prefer a prompt? Paste this to your agent
Run `npx skills use "https://github.com/cyanheads/obsidian-mcp-server" --skill "cyanheads/obsidian-mcp-server/security-pass"` and follow the generated skill instructions now. Read its complete output, redirecting it to a temporary file first if necessary. Resolve relative paths from the supporting-files directory it provides.
Use the skills in "https://github.com/cyanheads/obsidian-mcp-server" that are relevant to the current task. Run `npx skills add "https://github.com/cyanheads/obsidian-mcp-server"` and select the relevant skills, then follow their instructions.
Related
6 picksType
- azure-messagingTroubleshoot and resolve issues with Azure Messaging SDKs for Event Hubs and Service Bus.Jul 2026
- lark-openapi-explorer飞书/Lark 原生 OpenAPI 探索：从官方文档库中挖掘未经 CLI 封装的原生 OpenAPI 接口。当用户的需求无法被现有 lark-* skill 或 lark-cli 已注册命令满足，需要查找并调用原生飞书 OpenAPI 时使用。Jul 2026
- lark-skill-maker创建 lark-cli 的自定义 Skill。当用户需要把飞书 API 操作封装成可复用的 Skill（包装原子 API 或编排多步流程）时使用。Jul 2026
- implementImplement a piece of work based on a spec or set of tickets.Jul 2026
- supabaseUse when doing ANY task involving Supabase. Triggers: Supabase products (Database, Auth, Edge Functions, Realtime, Storage, Vectors, Cron, Queues); client…Jul 2026
- firebase-basicsProvides foundational setup, authentication, and project management workflows for Firebase using the Firebase CLI.Jul 2026
