
Research
/Security News
CanisterWorm: npm Publisher Compromise Deploys Backdoor Across 29+ Packages
The worm-enabled campaign hit @emilgroup and @teale.io, then used an ICP canister to deliver follow-on payloads.
@tigerdata/tiger-skills-mcp-server
Advanced tools
Emulate Claude Skills with any LLM via a Model Context Protocol (MCP) server.
Skills are modular components that enhance the capabilities of an MCP-compatible agent by providing specific functionalities, workflows, and domain expertise. They transform a general-purpose agent into a specialized agent equipped with procedural knowledge that no model can fully possess.
The goal is to be fully compatible with Anthropic's skill format. See their Agent Skills Spec and related documentation for more details.
Skills are modular, self-contained packages that extend agent capabilities by providing specialized knowledge, workflows, and tools. Think of them as "onboarding guides" for specific domains or tasks—they transform the agent from a general-purpose agent into a specialized agent equipped with procedural knowledge that no model can fully possess.
Every skill consists of a required SKILL.md file and optional bundled resources:
skill-name/
├── SKILL.md (required)
│ ├── YAML frontmatter metadata (required)
│ │ ├── name: (required)
│ │ └── description: (required)
│ └── Markdown instructions (required)
└── Bundled Resources (optional)
├── scripts/ - Executable code (Python/Bash/etc.)
├── references/ - Documentation intended to be loaded into context as needed
└── assets/ - Files used in output (templates, icons, fonts, etc.)
Metadata Quality: The name and description in YAML frontmatter determine when the agent will use the skill. Be specific about what the skill does and when to use it. Use the third-person (e.g. "This skill should be used when..." instead of "Use this skill when...").
scripts/)Executable code (Python/Bash/etc.) for tasks that require deterministic reliability or are repeatedly rewritten.
scripts/rotate_pdf.py for PDF rotation tasksreferences/)Documentation and reference material intended to be loaded as needed into context to inform the agent's process and thinking.
references/finance.md for financial schemas, references/mnda.md for company NDA template, references/policies.md for company policies, references/api_docs.md for API specificationsassets/)Files not intended to be loaded into context, but rather used within the output the agent produces.
assets/logo.png for brand assets, assets/slides.pptx for PowerPoint templates, assets/frontend-template/ for HTML/React boilerplate, assets/font.ttf for typographySkills use a three-level loading system to manage context efficiently:
*Unlimited because scripts can be executed without reading into context window.
The set of skills is configured via a YAML file. Both local directories and GitHub repositories are supported. Config can point to individual skills or collections of skills.
local-directory-collection:
# A collection of local skills stored in the `./skills` directory.
# Each skill should be in its own subdirectory with a `SKILL.md` file.
type: local_collection
path: ./skills
local-individual-skill:
# An individual local skill stored in the `./skills/skill-name` directory.
type: local
path: ./path-to/individual/skill-name
anthropic-github-collection:
# A GitHub repo containing a collection of skills.
# Each skill should be in its own subdirectory with a `SKILL.md` file.
type: github_collection
repo: anthropics/skills
# path: ./ # not needed for this example since skills are at the root of the repo
# Optionally specify skills/paths to ignore in this collection
ignored_paths:
- .claude-plugin
- document-skills
disabled_skills:
- canvas-design
# Setting enabled_skills will _only_ load the specified skills from the collection
# enabled_skills:
# - frontend-design
# - webapp-testing
single-github-skill-example:
# A GitHub repo containing an individual skill.
type: github
repo: anthropics/claude-cookbooks
path: ./skills/custom_skills/creating-financial-models
Skill names must be unique across all configured skills. Any duplicates will be ignored with a warning.
Individual clients can control the set of skills that are enabled, as well as the protocol(s) used, via parameters in the connection string.
enabled_skills: Comma-separated list of skill keys to enable. If not provided, all configured skills are enabled.disabled_skills: Comma-separated list of skill keys to disable. If not provided, no skills are disabled.tools=0: Disable all tools (for resource-only integration).resources=0: Disable all resources (for tool-only integration).http://tiger-skills-mcp-server/mcp?disabled_skills=foo,bar&resources=0
Cloning and running the server locally.
git clone git@github.com:timescale/tiger-skills-mcp-server.git
Run npm i to install dependencies and build the project. Use npm run watch to rebuild on changes.
You will need a GitHub token with the correct scopes. Here is a direct link to create such a new token.
Create a .env file based on the .env.sample file.
cp .env.sample .env
Then update the GITHUB_TOKEN value in .env.
The MCP Inspector is a very handy to exercise the MCP server from a web-based UI.
npm run inspector
npm run watch
| Field | Value |
|---|---|
| Transport Type | Streamable HTTP |
| URL | http://localhost:3001/mcp |
npm run watch:stdio
| Field | Value |
|---|---|
| Transport Type | STDIO |
| Command | node |
| Arguments | dist/index.js |
Create/edit the file ~/Library/Application Support/Claude/claude_desktop_config.json to add an entry like the following, making sure to use the absolute path to your local tiger-skills-mcp-server project, and use a valid GitHub token.
{
"mcpServers": {
"tiger-skills": {
"command": "node",
"args": [
"/absolute/path/to/tiger-skills-mcp-server/dist/index.js",
"stdio"
],
"env": {
"GITHUB_TOKEN": "ghp_whatever",
"GITHUB_ORG": "timescale"
}
}
}
}
FAQs
MCP server to provide an agent with skills
We found that @tigerdata/tiger-skills-mcp-server demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 2 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
/Security News
The worm-enabled campaign hit @emilgroup and @teale.io, then used an ICP canister to deliver follow-on payloads.

Research
/Security News
Attackers compromised Trivy GitHub Actions by force-updating tags to deliver malware, exposing CI/CD secrets across affected pipelines.

Security News
ENISA’s new package manager advisory outlines the dependency security practices companies will need to demonstrate as the EU’s Cyber Resilience Act begins enforcing software supply chain requirements.