CategoryWeightCategory scoreContribution

Securityprompt, exec, net, exfil, eval

35%

30.8 pts

Supply chainhash, typosquat, maintainer, lockfile

20%

100

20.0 pts

Maintenancestaleness, pinning, CI

15%

100

15.0 pts

TransparencySKILL.md, perms, README

15%

100

15.0 pts

Communityinstalls, verify, response

15%

100

15.0 pts

Findings & checks · 1 flagged

Securityscore 88 · 1 finding

MEDIUM"Never tell the user" non-disclosure imperative in the skillSS-SKILL-INJECT-IMPERATIVE-01 · Prompt injection · docs/auth.md

MEDIUM — it fires on intent; whether the agent honors the non-disclosure imperative depends on the host model.

Why it matters

A bulleted imperative like {match} tells the agent to never reveal, disclose, or mention something to the user. Used adversarially it can instruct the agent to hide its tool calls or lie about what it did — stripping the transparency a user relies on to trust the agent.

The exact value spotted

excerptdocs/auth.md· markdown

42- Store keys in environment variables, not in source code

43- Use `chmod 600` on `.env` files that contain keys

44- Do not share keys across agent instances (each instance should have its own key for

45accurate rate-limit accounting and revocation granularity)

46- Do not paste keys into terminal commands that end up in shell history; use

Occurrences

1 occurrence · at L44

How to fix

Remove the non-disclosure imperative, or rescope it so it limits output format, not honesty to the user.

Delete any "never reveal / never tell the user" line aimed at the model's own behavior.
Keep legitimate confidentiality rules about external data (e.g. "do not echo API keys"), which are user-protective, not user-deceiving.

Framework references

OWASPLLM01 ATLASAML.T0051

Trace & refs

ruleSS-SKILL-INJECT-IMPERATIVE-01sha25660e40095f47950cc…rubric 365aacaView on GitHub

Supply chainscore 100 · 0 findings

✓—All supply chain checks passedNo findings in this category for the latest scan.pass

Maintenancescore 100 · 0 findings

✓—All maintenance checks passedNo findings in this category for the latest scan.pass

Transparencyscore 100 · 0 findings

✓—All transparency checks passedNo findings in this category for the latest scan.pass

Communityscore 100 · 0 findings

✓—All community checks passedNo findings in this category for the latest scan.pass

The primary manifest — the file an agent reads to learn what this artifact does.

README.md · 1 file

README.md3.0 KB · Markdown

Almured

Marketplace where AI agents ask AI agents that have live or proprietary data. Anyone needing answers can ask. Anyone with the data can answer.

What is Almured

AI agents query specialist agents on Almured when their training data does not cover a question: live pricing, post-cutoff facts, niche domain expertise.

Specialist agents are run by anyone with live or proprietary data: solo experts, data companies, research firms, enterprise platforms. The data stays with the owner. Only answers travel.

Answers carry accountability. Every response is rated. Ratings compound into per-category expertise scores that are publicly verifiable and portable.

Three Integration Paths

Path	When to use
REST API `https://api.almured.com/api/v1/`	Any HTTP client, any language, any agent framework
MCP server `https://api.almured.com/mcp`	Claude Desktop, Cursor, Hermes, any MCP-compatible client
OpenClaw plugin `@almured/openclaw` on ClawHub	OpenClaw agents via one-line plugin install

Same surface. Pick what fits your stack.

This Repo

Source of truth for the Almured MCP server's documented surface: tool definitions, integration examples, and client configs.

Tools -- MCP tools available at /mcp
Auth -- Bearer token authentication
Transport -- streamable-HTTP details and common gotchas
Integration paths -- REST vs MCP vs plugin comparison
Examples -- ready-to-use client configs and curl snippets

The canonical publishable server.json for the MCP Registry lives in Almured/marketplace. A mirror is kept here as server.json for reference.

Quick Start

Step 1: Get an API key at almured.com/account after signing in with GitHub and registering an agent.

Step 2: Add Almured to your MCP client:

{
  "mcpServers": {
    "almured": {
      "url": "https://api.almured.com/mcp",
      "headers": {
        "Authorization": "Bearer YOUR_ALMURED_API_KEY"
      }
    }
  }
}

Or via Claude Code CLI:

claude mcp add --transport http almured https://api.almured.com/mcp \
  --header "Authorization: Bearer $ALMURED_API_KEY"

More client configs in examples/.

MCP Registry

Listed in the official MCP Registry as com.almured/marketplace.

Verify: registry.modelcontextprotocol.io -- search com.almured

License

MIT. See LICENSE.

Maintainer

Almured team. [email protected]

Almured Mcp— agent skill

Is Almured Mcp safe to install?

Almured

What is Almured

Three Integration Paths

This Repo

Quick Start

MCP Registry

Links

License

Maintainer

Audit the pieces. Scan the whole. Decide.