update-b8e58e — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited update-b8e58e (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
This .claude/skills/update/ override is auto-discovered only inside the Roslyn-Backed-MCP repo checkout and takes precedence over the shipped skills/update/SKILL.md when present. It exists because shipped skills are scanned for repo-specific paths (eng/...) by eng/verify-skills-are-generic.ps1 — so the shipped skill has to stay on the /plugin slash-command path, but maintainers in-repo have a PowerShell updater that works when the client refuses /plugin.
Call server_info. Report current version, latest NuGet version, updateAvailable.
dotnet tool update -g Darylmcd.RoslynMcp || dotnet tool install -g Darylmcd.RoslynMcpIn-repo alternatives: just tool-update (NuGet.org) or just tool-install-local after just pack.
Preferred (agent-executable, works even when `/plugin` slash-commands are unavailable):
pwsh -NoProfile -File eng/update-claude-plugin.ps1The script replicates /plugin marketplace update + /plugin install without going through the client:
git pulls the marketplace clone at ~/.claude/plugins/marketplaces/roslyn-mcp-marketplace/~/.claude/plugins/cache/roslyn-mcp-marketplace/roslyn-mcp/<new-version>/ from git-tracked files only (710+ files at 1.29.0)<old-version>/ cache directoriesinstalled_plugins.json + known_marketplaces.json with the new version, commit SHA, and UTC timestampRequires the plugin to have been installed through Claude Code at least once (so the marketplace clone exists). Reports resolved version, target cache dir, copied-file count, and pruned stale dirs.
Fallback (chat-side, if you prefer to go through the client):
/plugin marketplace update roslyn-mcp-marketplace
/plugin install roslyn-mcp@roslyn-mcp-marketplaceIf the client responds with /plugin isn't available in this environment, use the PowerShell path above.
Same as the shipped skill — previous version, new version, layers updated, reminder to restart Claude Code.
During the v1.29.0 release-cut (PR #377), the Claude Code client refused /plugin slash-commands with /plugin isn't available in this environment. Layer 1 was updated via just tool-install-local but Layer 2 sat at 1.28.1 in the plugin cache. The repo already shipped eng/update-claude-plugin.ps1 (a maintainer-only script, agent-executable, idempotent) that does exactly what the two slash-commands do — it just wasn't the documented primary path because the shipped skill isn't allowed to reference repo-specific eng/ paths under verify-skills-are-generic.ps1. This override closes that gap for anyone running /roslyn-mcp:update from inside the Roslyn-Backed-MCP repo.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.