In skills/autonomous-agent-harness/SKILL.md, the Setup Guide (Step 1: Configure MCP Servers) lists three npm packages to install via npx -y:
@anthropic/memory-mcp-server@anthropic/scheduled-tasks-mcp-server@anthropic/computer-use-mcp-server
None of these exist on the public npm registry (verified: all three return 404). The @anthropic scope itself appears unclaimed — @anthropic/sdk also 404s, while Anthropic's real published packages are under the @anthropic-ai scope (e.g. @anthropic-ai/sdk, which resolves).
Running npx -y against an unclaimed scope fails safely today, but if anyone later publishes a package under those exact names, someone following this guide would silently install and run untrusted code with full MCP tool access. Worth either removing that block or replacing it with real, published MCP server package names.
Also, https://api.anthropic.com/dispatch referenced later in the same Setup Guide section doesn't appear to be a real Anthropic API endpoint, for what it's worth — the whole section may be aspirational rather than a verified working setup.
In
skills/autonomous-agent-harness/SKILL.md, the Setup Guide (Step 1: Configure MCP Servers) lists three npm packages to install vianpx -y:@anthropic/memory-mcp-server@anthropic/scheduled-tasks-mcp-server@anthropic/computer-use-mcp-serverNone of these exist on the public npm registry (verified: all three return 404). The
@anthropicscope itself appears unclaimed —@anthropic/sdkalso 404s, while Anthropic's real published packages are under the@anthropic-aiscope (e.g.@anthropic-ai/sdk, which resolves).Running
npx -yagainst an unclaimed scope fails safely today, but if anyone later publishes a package under those exact names, someone following this guide would silently install and run untrusted code with full MCP tool access. Worth either removing that block or replacing it with real, published MCP server package names.Also,
https://api.anthropic.com/dispatchreferenced later in the same Setup Guide section doesn't appear to be a real Anthropic API endpoint, for what it's worth — the whole section may be aspirational rather than a verified working setup.