rudder-profiles-setup — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited rudder-profiles-setup (Agent Skill) and scored it 92/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 2 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 2 flagged
The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Set up the local Profiles toolchain so later skills can discover warehouse metadata, generate YAML, and run pb commands safely.
Check these before anything else:
| Prerequisite | Check | If missing |
|---|---|---|
| Python 3.10+ | which python3 and python3 --version | Install from python.org or system package manager |
| uv | which uv | Install from https://docs.astral.sh/uv/getting-started/installation/ |
| git | which git | Install from git-scm.com or system package manager |
which python3, which uv, which git. If any are missing, explain what to install and stop.git clone https://github.com/rudderlabs/profiles-mcp into a user-approved location. Skip if already cloned..env file needs RUDDERSTACK_PAT, IS_CLOUD_BASED, and USE_PB_QUERY. Do not ask the user to paste secrets into chat. Instead, instruct them to copy .env.sample to .env and fill in values, or let setup.sh handle it via its interactive env_setup.py step.profiles-mcp checkout. This script:uv if missing,start.sh wrapper,env_setup.py (interactive — prompts for PAT via masked input),.venv,pb CLI,update_mcp_config.py to wire MCP into the user's editor.setup.sh did not handle this, or if the user needs manual config:claude mcp add profiles -- /path/to/profiles-mcp/.venv/bin/python /path/to/profiles-mcp/server.pyreferences/mcp-config-examples.mdpb version succeeds AND at least one Profiles MCP tool is visible to the agent./rudder-profiles-project to create their first project.profiles-mcp as the source of truth for editor wiring and environment variables./rudder-profiles-project.pb init connection) — that belongs in the project workflow.rudder-mcp-server) — use the existing rudder-mcp-setup skill.setup.sh / env_setup.py), existing shell environment variables, or direct local file edits that do not echo secrets back..env, write placeholder keys only after confirming the file is in .gitignore..env, siteconfig.yaml, or command output that may contain tokens.Setup is complete when all of the following are true:
pb version succeeds.references/mcp-config-examples.md for editor config snippets and post-setup checks.~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.