tdmcp-submission-dcb67f — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited tdmcp-submission-dcb67f (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Coordinates four agents to prepare (and re-prepare) tdmcp's submission to the Anthropic Connectors Directory via the Desktop Extension (MCPB) path. Defines who works when; each agent's skill defines how.
TeamCreate/SendMessage are not available here, so run agents as sub-agents with the Agent tool. For every agent:
subagent_type: "general-purpose", model: "opus"..codex/agents/*.tomland its required skill(s) first, then do the task. Use this exact mapping: architect → .codex/agents/submission-architect.toml, docs-author → .codex/agents/docs-author.toml, bundle-engineer → .codex/agents/bundle-engineer.toml, and submission-qa → .codex/agents/submission-qa.toml. The definition file is the source of truth (reusable next session); the prompt just points at it + passes the task and the relevant _workspace/ paths.
Agent calls in one message(or run_in_background: true).
_workspace/Create _workspace/ at the repo root for inter-agent artifacts:
00_submission-spec.md — architect → everyone01_migration-notes.md — bundle-engineer → QA/human02_form-answers.md — docs-author → QA/human (paste-ready form draft)03_qa-report.md — QA → humanFinal deliverables (privacy page, edited repo files, tdmcp.mcpb) land in the repo proper. _workspace/ is preserved for audit / re-runs.
_workspace/ is absent → initial run: full pipeline below._workspace/ exists and the user asks to fix/update one part → **partialre-run**: re-invoke only the affected agent(s), pass the prior artifacts + the new feedback (e.g. a directory rejection reason). E.g. "privacy page rejected" → docs-author only, then QA.
_workspace/ exists and the user gives fresh inputs → move it to_workspace_prev/ and start a new initial run.
00_submission-spec.md. Everythingdownstream depends on it — do not parallelize anything before it finishes.
config.ts nav additions,02_form-answers.md. (Prose lane.)
dxt/manifest.json, scripts/build-dxt.mjs,package.json scripts, scripts/setup.mjs, .dxt→.mcpb text sweep in existing docs, .github/ release workflow, 01_migration-notes.md. (Code lane.)
03_qa-report.md. If it reports blocking issues, loop back to the owning agent (partial re-run), then re-run QA on the affected checks.
proceed and record the gap in the final summary; never silently drop it.
--no-verify, deleting a check). A red QA gate isthe signal to fix, not to suppress.
the live tool/repo, and have the architect update the spec rather than forcing the stale value.
Summarize to the user (in Portuguese): what changed in the repo, the contents of 02_form-answers.md and the QA verdict, and the explicit Needs human before submit list (support email, privacy contact, cutting a new release so the .mcpb asset exists, and the actual form click — which only the user can do). Then offer to address any QA nits or feedback.
_workspace/ → architect spec → privacy page + form draft +.mcpb migration → npm run docs:build and build:mcpb pass → QA all-PASS except human-input items → summary lists those items.
→ Phase 0 detects existing _workspace/ → re-invoke docs-author with that feedback → QA re-checks the privacy gate only → updated summary.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.