mushi-health — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited mushi-health (Agent Skill) and scored it 45/100 (orange). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 1 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 1 flagged
A base64 string of 128+ characters appears in a documentation file. Encoded prompt injection hides the hostile instruction in base64 — invisible to keyword filters — and relies on the agent's ability to decode it at runtime. There is no normal authoring reason to embed a multi-hundred-byte base64 blob in skill docs.
*.sig, SIGNATURES) outside the documentation.Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Run these checks in order. Stop and fix at the first ❌ before continuing.
| # | Component | How to check |
|---|---|---|
| 1 | CLI credentials | mushi doctor |
| 2 | API + edge functions | mushi deploy check |
| 3 | Project overview | mushi status |
| 4 | BYOK key pool | mushi keys list or MCP list_byok_keys |
| 5 | Supabase logs | Supabase MCP get_logs |
| 6 | QA cron running | DB query on qa_story_runs |
mushi doctorExpected output — all lines green:
✓ ~/.mushirc found
✓ MUSHI_API_KEY valid (mushi_...)
✓ MUSHI_API_ENDPOINT reachable (200 OK)
✓ MUSHI_PROJECT_ID matches a live project
✓ Feature flags fetchedFix if red: Re-run mushi login --api-key mushi_... --endpoint https://<ref>.supabase.co/functions/v1/api --project-id <pid>.
mushi deploy checkProbes each edge function with a lightweight ping. Healthy output:
✓ api
✓ classify-report
✓ fix-worker
✓ story-mapper
✓ test-gen-from-story
✓ pdca-runner
✓ qa-story-runnerA ✗ on any line means that function is down. Check its logs in Step 5.
mushi statusConfirm:
autofix_agent shows the expected agent (cursor_cloud, mcp, etc.).billing: quota_exceeded warning.Via CLI:
mushi keys listVia MCP (if the Mushi MCP server is active in Cursor):
list_byok_keys(projectId)Healthy: at least one anthropic key with status=active, at least one firecrawl key with status=active.
Fix: Add a missing or exhausted key:
mushi keys add --provider anthropic --key sk-ant-... --label "primary" --priority 100
mushi keys add --provider firecrawl --key fc-... --label "primary" --priority 100Use the Supabase MCP (requires SUPABASE_ACCESS_TOKEN in MCP config):
get_logs(service: 'api')Look for ERROR lines in the last 15 minutes, especially from:
story-mapper — Firecrawl timeout or Claude quotatest-gen-from-story — LLM key exhaustedpdca-runner — failed PDCA cycleqa-story-runner — Browserbase quota or Firecrawl errorIf the Supabase MCP is not wired in Cursor, use the CLI:
supabase functions logs story-mapper --project-ref <ref>
supabase functions logs qa-story-runner --project-ref <ref>Verify scheduled tests are executing (requires Supabase MCP):
SELECT status, COUNT(*)
FROM qa_story_runs
WHERE created_at > NOW() - INTERVAL '2 hours'
GROUP BY status;Healthy output: at least one completed row in the last 2 hours (if you have enabled stories).
If qa_story_runs is empty:
enabled = true and approval_status = 'approved'.SELECT jobname, schedule FROM cron.job WHERE jobname LIKE 'qa%';mushi tdd run <qa-story-id> and re-check.After running all steps, record results:
| Component | Status | Notes |
|---|---|---|
| CLI credentials | ✅ / ❌ | |
| Edge functions | ✅ / ❌ | Which ones failed? |
| Project overview | ✅ / ❌ | Billing ok? |
| BYOK key pool | ✅ / ❌ | Missing providers? |
| Supabase logs | ✅ / ❌ | Any ERRORs? |
| QA cron | ✅ / ❌ | Last run at? |
If all ✅ → pipeline is healthy. If any ❌ → use mushi-debug for targeted diagnosis.
| Symptom | Likely cause | Fix |
|---|---|---|
mushi doctor can't reach endpoint | Wrong MUSHI_API_ENDPOINT in ~/.mushirc | Re-run mushi login --endpoint https://... |
| All edge functions ❌ | Supabase project paused (free tier) | Restore the project in the Supabase dashboard |
BYOK keys all quota_exhausted | Rate limits hit on all keys | Add a backup key for each provider |
| QA cron never fires | pg_cron job missing | Re-run migration 20260602000003_pdca_qa_improve_cron.sql |
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.