Stoop — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited Stoop (Agent Skill) and scored it 87/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 1 high-severity and 1 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 2 flagged
The text {match} is the classic direct prompt-injection phrasing. Placed in a skill body that the agent reads as trusted instructions, it tries to make the agent abandon its prior rules and follow whatever comes next — a full system-prompt override.
ignore/disregard/forget … previous instructions sentence.The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Stoop is an MCP server that turns AI conversations into real contractor matches. Ask Claude for a plumber, HVAC tech, or electrician in Miami — get 3 licensed, rated providers with phone numbers and pricing, instantly.
No more Googling. No more opening 5 tabs. No more calling random numbers.
You ask Claude something like:
"My kitchen faucet is leaking, I need a plumber in Miami"
Stoop returns 3 verified providers ranked by license status, ratings, proximity, and pricing — with direct call/text links.
What you get:
Add this to your claude_desktop_config.json:
macOS: ~/Library/Application Support/Claude/claude_desktop_config.json Windows: %APPDATA%\Claude\claude_desktop_config.json
{
"mcpServers": {
"stoop": {
"command": "npx",
"args": [
"mcp-remote",
"https://stoop-mcp-server.stoop.workers.dev/mcp"
]
}
}
}Restart Claude Desktop. You're done.
Ask Claude any of these:
| Trade | Coverage | License Type |
|---|---|---|
| Plumbing | 234 providers | FL CFC License |
| Electrical | 230 providers | FL EC License |
| HVAC | 175 providers | FL CAC License |
All providers are in the Miami-Dade and Broward County metro area. Data sourced from Google Places, Yelp Fusion, and the Florida Department of Business and Professional Regulation (DBPR).
Stoop exposes 4 tools via the Model Context Protocol:
| Tool | Description |
|---|---|
service_search | Search for providers by trade, location, urgency, and budget |
provider_profile | Get detailed info on a specific provider (license, hours, reviews) |
home_profile | Store your home details to improve future matches |
job_history | View your past searches and contacts |
Providers are scored on a 100-point scale:
| Factor | Points | Notes |
|---|---|---|
| Active FL license | 30 | Verified against DBPR |
| Star rating | 0–20 | Scaled from Google/Yelp rating |
| Review count | 0–15 | Log scale, caps at ~150 reviews |
| Proximity | 0–15 | 1 point per mile closer |
| Availability | 10 | Assumed available in v1 |
| Price match | 10 | Within your budget |
| Emergency boost | +15 | For urgent requests only |
Miami metro only (Miami-Dade + Broward County). Three trades: HVAC, Plumbing, Electrical.
More cities and trades coming based on demand.
This is an early-stage product. Issues and feedback welcome at github.com/oliverhpage/stoop/issues.
MIT
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.