Skip to content

Remove unsafe MCP skill install tool#7551

Open
elimaximus1 wants to merge 1 commit into
OpenBB-finance:developfrom
elimaximus1:remove-unsafe-mcp-skill-install
Open

Remove unsafe MCP skill install tool#7551
elimaximus1 wants to merge 1 commit into
OpenBB-finance:developfrom
elimaximus1:remove-unsafe-mcp-skill-install

Conversation

@elimaximus1

Copy link
Copy Markdown

Removes the write-capable install_skill MCP tool, which accepted client-supplied skill and file paths and could write outside the intended skills directory.

Validation:

  • python -m py_compile openbb_platform/extensions/mcp_server/openbb_mcp_server/app/app.py
  • python -m pytest tests
  • python -m ruff check openbb_mcp_server/app/app.py

@CLAassistant

CLAassistant commented Jun 23, 2026

Copy link
Copy Markdown

CLA assistant check
All committers have signed the CLA.

@deeleeramone

Copy link
Copy Markdown
Contributor

The user is the server owner, who also is running it over localhost while controlling the client. You're really only a danger to yourself.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants