mb-cli — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited mb-cli (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Use this skill whenever the task involves mb.
mb heartbeat.mb inbox when deciding whether something deserves a reply.mb catchup when you want bounded reading rather than a compact summary.agent output for exploration and pipelines.--format json only when a downstream step truly needs structured parsing.mb lookup ....Cheap reads:
mb heartbeat
mb inbox
mb catchup
mb whoami
mb timeline --count 10
mb user following
mb user discover
mb discover --list
mb discover --collection booksExplicit enrichment:
mb user following | mb lookup users --last-post
mb user following | mb lookup users --days-since-postingmb heartbeat is the default session-start check for agent use.heartbeat_checkpoint, which is separate from timeline checkpoint.mb heartbeat --no-advance to inspect without saving.mb heartbeat --mentions-only when the task is reply triage rather than broad reading.mb inbox is the reply-triage surface.mb catchup is the bounded read-what-is-new surface.mb inbox, mb catchup, and mb heartbeat each use separate checkpoints.mb checkpoint list when cursor state is unclear.mb checkpoint clear <name> to reset a stuck workflow cursor.mb lookup posts --conversation - when a thread needs more context.mb post ... creates or edits public content unless the user clearly says otherwise.Show candidates before acting:
mb user following | mb lookup users --days-since-posting
mb discover --collection books
mb user discoverAct only after the intent is clear:
... | mb unfollow -
... | mb follow -Session start:
mb heartbeat
mb heartbeat --no-advance
mb heartbeat --mentions-only
mb heartbeat --count 3 --mention-count 3
mb inbox
mb inbox --reason thread-reply
mb inbox --fresh-hours 24
mb inbox --all
mb inbox --advance
mb catchup
mb catchup --advance
mb checkpoint list
mb checkpoint clear inboxIdentity and config:
mb whoami
mb profiles
mb blogs
mb doctor --offlinePosting:
mb post new "Text" --operation-id example-1
mb post short "Short text" --operation-id example-2
mb post new --content "Text" --operation-id example-3
mb post new --file post.md --operation-id example-4
mb post short --strict-300 "Short text" --operation-id example-5
mb post new --dry-run "Text"
mb media upload image.jpg --alt "Description" --operation-id example-6
mb post new "Text" --photo-url https://cdn.micro.blog/... --alt "Description" --operation-id example-7
mb post edit <id-or-url> --content "Updated" --operation-id example-8
mb post reply <id-or-url> "Reply text" --operation-id example-9
mb post publish <url> --source-hash HASH --operation-id example-10Reading:
mb timeline
mb timeline mentions
mb conversation <id>
mb blog posts
mb blog search "query"
mb discover --list
mb discover --collection books
mb user show <username>Lookup and follow management:
mb user following | mb lookup users --last-post
mb user following | mb lookup users --days-since-posting
mb lookup posts --post 12345
mb lookup posts --conversation 12345
mb inbox | mb lookup posts --conversation -
mb follow <username|->
mb unfollow <username|->--operation-id and exact arguments before invoking a write. Reuse both on retries; never generate a fresh ID after an uncertain outcome. Ordinary human CLI use may omit the ID (one is generated and saved per invocation), so a plain rerun is a new write.--state-file) shared with any MCP client on the same account.outcome=unknown, run the printed mb operation-status ... command (or mb operation-status --latest) and read back from micro.blog. Do not resend. Recording the verified outcome with mb operation-status ID --resolve applied|not_applied is the human's decision; propose it, don't run it on your own judgment.mb doctor lists pending and unknown receipts with resolve hints.mb post get URL --format json, review the source, then mb post publish URL --source-hash HASH --operation-id ID. Publishing moves the post to a new URL; use the result's url afterwards (draft_url is the retired one).mb media upload FILE --alt TEXT uploads a local JPEG, PNG, GIF or WebP (up to 20 MiB) exactly as provided. It does not strip EXIF or GPS metadata; check with the user before uploading a photo that may carry location data. mb media preview FILE --alt TEXT shows type, size and sha256 without uploading; pass that --sha256 to upload to refuse a changed file. HTTP 202 means accepted but possibly still processing. Attach the returned URL with mb post new ... --photo-url URL --alt TEXT under a different operation ID. Never repeat an upload merely because creating the post failed. Combined --photo and remote-URL uploads are removed.
mb post replies, mb user show NAME --count N, mb discover --count N and mb conversation URL are account reads. mb blog posts/search/categories are selected-blog reads over a bounded window, not a complete category audit. mb user mute WORD --keyword mutes a keyword. Metadata such as coverage= and mb lookup users errors go to stderr; stdout carries only records.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.