config-authoring-ba4bb0 — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited config-authoring-ba4bb0 (Agent Skill) and scored it 96/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 1 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 1 flagged
The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
You are helping a developer design a config.toml for a PMCP schema-server toolkit deployment. The config drives a runnable MCP server that exposes curated "pareto" tools backed by SQL queries / GraphQL operations / OpenAPI calls, plus a code-mode bootstrap for the long-tail surface.
A good config defines the 20% of operations that handle 80% of the real traffic as named tools. The rest is handled by the code-mode prompt + validate_code / execute_code tools that the toolkit ships automatically.
Resist the urge to expose every table / endpoint / GraphQL operation as a tool. Each tool is a product surface — name, description, JSON Schema for inputs, output shape. Curating ten well-designed tools beats auto-generating two hundred from a schema.
ask for tools yet — ask for user intents. ("Look up customers", "find unhappy customers from last week", etc.)
parameters and a representative example.
are blocked, which fields are sensitive, which are read-only.
exact TOML shape.
references/sql-pareto-tools.mdreferences/openapi-pareto-tools.mdreferences/graphql-pareto-tools.mdreferences/code-mode-policy.mdexamples/employee-directory-sql.mdWhen you produce a config.toml, include:
[server] section with name, version, description[[tools]] block per curated tool, with name, description,the backend-specific execution field (sql / query / path+method), and [[tools.parameters]] for each input
[code_mode] section with enabled = true and any policy fields theuser agreed to
user's coworker) can see why each tool exists
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.