C — Moderate risk signals Graded October 16, 2026Several concerns worth a closer look before you install.Based on public adoption and transparency signals as of October 16, 2026. Our opinion, not a code audit or security guarantee.
App connector · Developer tools, Files & documents
agent-install
Install SKILL.md files, MCP servers, and AGENTS.md guidance for any coding agent. Ships both a Node API and a CLI.
Bottom line: Signal-based grade (2/7 points): heavily downloaded, no public source code found. This reflects adoption and transparency, not a code review.
- Popularity score
- 48/100
- Rank
- #149 of 500
- Weekly downloads
- 3.1M
What it does
agent-install is an MCP connector that enables coding agents to install SKILL.md files, MCP servers, and AGENTS.md guidance into their environments via both Node.js API and CLI interfaces. It simplifies bootstrapping and configuration for AI agents that need to extend their capabilities dynamically.
Who it’s for
AI builders and platform maintainers who deploy coding agents and want to automate agent capability setup across multiple instances. Executives overseeing agent infrastructure can use this to standardize skill distribution.
Copy-paste setup
Check these steps against the project’s own instructions before running anything.
Install from npm (check the project page first):
npx -y agent-install
Follow the official instructions: https://www.npmjs.com/package/agent-install (opens external site)
Risks
- Arbitrary code execution: Installing SKILL.md and MCP server files from untrusted sources could allow injection of malicious code into agent environments.
- Supply chain vulnerability: High weekly download volume (3.1M+) makes this a potential attack surface; compromise of the package or its dependencies could affect many agents.
- Credential exposure in skill files: SKILL.md files may inadvertently bundle API keys, tokens, or configuration secrets if not carefully sanitized.
- Prompt injection via metadata: Malicious AGENTS.md guidance could contain adversarial prompts designed to manipulate agent behavior.
- Insufficient transparency: Zero GitHub stars and no public issue visibility make it difficult to assess maintenance status and known vulnerabilities.
How to stay secure
Least-privilege permissions
- Run agent-install with minimal filesystem access; restrict write permissions to a dedicated
/opt/agent-skills/directory only. - Execute MCP servers in isolated, unprivileged OS-level user accounts with no shell access or elevated capabilities.
- Require explicit manual approval before loading any SKILL.md or AGENTS.md file; disable auto-update and auto-install modes.
- Implement role-based access control to prevent agents from modifying their own skill files or configuration after installation.
Network isolation
- Restrict agent-install network access to a curated allowlist of known-safe package registries and repositories.
- Sandbox MCP server processes in network namespaces or containers with no access to internal service networks or cloud metadata endpoints.
- Enforce TLS certificate pinning for any remote SKILL.md or AGENTS.md downloads; reject unsigned or unverified sources.
- Block outbound connections from skill execution environments to external APIs unless explicitly declared and approved in advance.
Monitoring
- Log all SKILL.md, MCP server, and AGENTS.md file installations with source origin, hash, and timestamp; alert on unsigned or unknown sources.
- Monitor agent runtime behavior for suspicious syscalls, environment variable access, or attempts to exfiltrate credentials (regex scanning for API key patterns).
- Track dependency changes and security advisories for agent-install and all transitive npm dependencies; fail builds on high/critical CVEs.
- Audit file modifications in skill directories and flag unexpected writes or deletions outside normal agent lifecycle events.
Red flags to watch for
- SKILL.md files containing
require(),eval(), shell execution, or file I/O operations beyond documented agent APIs. - AGENTS.md guidance with jailbreak phrases, instructions to ignore safety constraints, or prompts designed to extract system information.
- Package versions pinned to old releases or dependency versions with known vulnerabilities; verify maintainer commit history and recent activity.
- Skill files that attempt to read environment variables,
/proc/, cloud credentials, or access sibling agent configurations.
Alternatives
- Hugging Face Hub / Model Card ecosystem: Standardized skill and capability sharing with community review mechanisms.
- LangChain / LlamaIndex tool registries: Curated, versioned tool and skill installations with dependency management.
- OpenAI GPT plugins / Anthropic tool definitions: Official vendor-managed connector ecosystems with security vetting.
- Custom deployment pipelines: In-house CI/CD and configuration management (Terraform, Ansible) for agent skill distribution.