show-wpf-dev-pack-config — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited show-wpf-dev-pack-config (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Print the on-disk WpfDevPackMcp configuration and server state so the user can see exactly what the MCP server reads and from where.
Run the file-based app and surface its output verbatim:
dotnet "${CLAUDE_PLUGIN_ROOT}/scripts/ShowWpfDevPackConfig.cs"It prints the absolute paths and current contents of:
~/.wpf-dev-pack-mcp/config.json — user-written repoPath + branch~/.wpf-dev-pack-mcp/state.json — server-managed LastPullUtc + Managedplus the WPFDEVPACK_REPO_PATH and WPFDEVPACK_PULL_TTL_MINUTES environment overrides. When `WPFDEVPACK_REPO_PATH` is set it overrides config.json's `repoPath` — a common cause of "the MCP isn't reading the repo I configured."
To change values: /wpf-dev-pack:set-repo-path (repoPath), /wpf-dev-pack:set-repo-branch (branch), /wpf-dev-pack:set-repo-managed (Managed flag).
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.