Is mcpbridge-workflow safe to install?

SaferSkills independently audited mcpbridge-workflow (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.

CategoryWeightCategory scoreContribution

Securityprompt, exec, net, exfil, eval

35%

100

35.0 pts

Supply chainhash, typosquat, maintainer, lockfile

20%

100

20.0 pts

Maintenancestaleness, pinning, CI

15%

100

15.0 pts

TransparencySKILL.md, perms, README

15%

100

15.0 pts

Communityinstalls, verify, response

15%

100

15.0 pts

Findings & checks · 0 flagged

Securityscore 100 · 0 findings

✓—All security checks passedNo findings in this category for the latest scan.pass

Supply chainscore 100 · 0 findings

✓—All supply chain checks passedNo findings in this category for the latest scan.pass

Maintenancescore 100 · 0 findings

✓—All maintenance checks passedNo findings in this category for the latest scan.pass

Transparencyscore 100 · 0 findings

✓—All transparency checks passedNo findings in this category for the latest scan.pass

Communityscore 100 · 0 findings

✓—All community checks passedNo findings in this category for the latest scan.pass

The primary manifest — the file an agent reads to learn what this artifact does.

.agents/skills/mcpbridge-workflow/SKILL.md · 1 file

.agents/skills/mcpbridge-workflow/SKILL.md4.4 KB · Markdown

name: mcpbridge-workflow

description: |

Task tracking and workflow management for the mcpbridge-wrapper project.

Use when working on mcpbridge-wrapper to: (1) Get the next task to work on,

(2) Mark tasks as completed, (3) View project progress, (4) List available tasks.

The workplan is stored in SPECS/Workplan.md with 65 tasks across 7 phases.

Task state is persisted in .task_state.json.

mcpbridge-workflow

Task tracking for the mcpbridge-wrapper project development.

Quick Start

Get the next task:

python3 scripts/pick_next_task.py

Mark a task done:

python3 scripts/pick_next_task.py --done P1-T1

Show progress:

python3 scripts/pick_next_task.py --progress
# Or use calc_progress.py for different output formats:
python3 scripts/calc_progress.py --markdown

List all tasks:

python3 scripts/pick_next_task.py --list

Workplan Structure

The workplan at SPECS/Workplan.md contains 66 tasks across 8 phases.

When to read the full workplan:

Before starting work on a task (to see full acceptance criteria)
To understand task dependencies in detail
To review the dependency graph or traceability matrix

For task format details, see references/task-format.md.

Phase	Focus	Tasks	P0 Tasks
1	Foundation & Scaffolding	6	3
2	Core Bridge Implementation	7	4
3	Response Transformation Engine	10	8
4	Edge Case Handling	9	0
5	Testing & Verification	14	8
6	Packaging & Distribution	8	3
7	Documentation	11	3

Task IDs follow the pattern P{phase}-T{task} (e.g., P1-T1, P3-T5).

Priority Levels

P0: Must complete for MVP (critical path)
P1: Should complete (important but not blocking)
P2: Nice to have (polish and enhancements)
P3: Future work (post-MVP)

Scripts

Two scripts are available for task management:

pick_next_task.py

Main task tracker with state persistence.

Location: scripts/pick_next_task.py

calc_progress.py

Calculate and display progress from workplan (no state tracking).

Location: scripts/calc_progress.py

Additional options:

python3 scripts/calc_progress.py --json       # JSON output
python3 scripts/calc_progress.py --markdown   # Markdown table
python3 scripts/calc_progress.py --todo       # Pending tasks only
python3 scripts/calc_progress.py --phase P1   # Phase 1 tasks

Default: Show Next Task

Without arguments, shows the highest-priority available task with unmet dependencies:

python3 scripts/pick_next_task.py

Output includes:

Task ID and description
Phase and priority
Dependency status (done/pending)
Acceptance criteria
Overall progress

Mark Task Complete

python3 scripts/pick_next_task.py --done TASK_ID

Example:

python3 scripts/pick_next_task.py --done P1-T1

Validates task ID exists in workplan before saving.

Show Progress

python3 scripts/pick_next_task.py --progress

Displays progress bars for each phase and P0 task completion counts.

List Tasks

python3 scripts/pick_next_task.py --list
python3 scripts/pick_next_task.py --list --phase 1

Shows all tasks with status (DONE/TODO) and blocking indicators.

Task Selection Logic

Tasks are selected based on:

All dependencies complete - Task is available
Phase order - Earlier phases take precedence
Priority - P0 before P1 before P2 before P3
Task ID - Alphabetical for tie-breaking

Blocked tasks (incomplete dependencies) are shown with [BLOCKED].

State Files

.task_state.json - Completed task IDs
.current_task - Current task suggestion (updated by script)

Both are gitignored.

Working a Task

Get the next task:

   python3 scripts/pick_next_task.py

Read the full task details in SPECS/Workplan.md

Implement the task

Run tests to verify:

   python3 -m pytest tests/ -v

Mark complete:

   python3 scripts/pick_next_task.py --done P1-T1

Commit with message referencing task ID:

   git add .
   git commit -m "P1-T1: Create project directory structure"

Completion Criteria

Project is complete when:

All P0 tasks: 100% complete
All P1 tasks: ≥80% complete
Test coverage: ≥90%
All 20 Xcode MCP tools verified (P5-T13)
Overhead <5ms verified (P5-T11)

mcpbridge-workflow— agent skill

Is mcpbridge-workflow safe to install?

mcpbridge-workflow

Quick Start

Workplan Structure

Priority Levels

Scripts

pick_next_task.py

calc_progress.py

Default: Show Next Task

Mark Task Complete

Show Progress

List Tasks

Task Selection Logic

State Files

Working a Task

Completion Criteria

Audit the pieces. Scan the whole. Decide.