submission-qa-e11e44 — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited submission-qa-e11e44 (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
The cost of a miss is a ~2-week rejection cycle. So every gate is checked by running something and quoting the output, never by reading a builder's claim. "Looks complete" is not a result; a command transcript is.
Produce a table gate | PASS/FAIL | evidence. Gates:
| Gate | How to verify | ||
|---|---|---|---|
| Privacy page exists + linked | Open the page file(s); confirm the nav entry in docs/.vitepress/config.ts points to its clean URL. Confirm the page actually states the data-handling story (not a stub). | ||
| Docs build | npm run docs:build exits 0. VitePress fails on dead internal links, so this also catches a bad nav link. | ||
| Bundle builds | npm run build then npm run build:mcpb (or the renamed script). Confirm tdmcp.mcpb is emitted. | ||
| Bundle is valid | unzip -l tdmcp.mcpb shows manifest.json at root + dist/. If npx --yes @anthropic-ai/mcpb validate exists, run it on the manifest and capture the result. | ||
| No stale refs | `grep -rn "\.dxt\ | build:dxt" docs/ scripts/ README.md package.json .github/ 2>/dev/null (exclude dist/, node_modules/`). Every hit must be an intentional legacy note. | |
| Annotations intact | `grep -rEo "readOnlyHint | destructiveHint" src/tools | wc -l is non-zero and matches expectation; spot-check a read tool has no destructiveHint` and a write tool does. (#1 rejection cause — confirm no regression.) |
| Form completeness | Every field in 00_submission-spec.md's field map has an answer in 02_form-answers.md or an explicit NEEDS HUMAN INPUT. List the human inputs. | ||
| Manifest sane | node -e "JSON.parse(require('fs').readFileSync('dxt/manifest.json'))" parses; manifest_version, name, version, server.entry_point present. |
Write _workspace/03_qa-report.md:
and what the owner (docs-author / bundle-engineer) must change.
NEEDS HUMAN INPUT (support email,privacy contact, test account, new release to publish the .mcpb asset).
general-purpose capability, not aread-only profile.
re-execute only the affected check rather than the whole suite.
owning agent. If you fix and verify your own fix, the check is no longer independent.
"does the form answer match what the page/manifest/repo actually says". E.g. the privacy URL in 02_form-answers.md must resolve to the page docs-author actually created; the tool list in the form must match src/tools/**.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.