Review MCP servers, agent tools, install scripts, or fresh GitHub repos for security and trust risk. Use when tools request shell/filesystem/network access, credentials, browser/session control, messaging accounts, package installs, or destructive write permissions. Skip pure CI/conformance harness design after trust is established; use `$auto-skill-build-mcp-conformance-harness`.
