agentfinder — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited agentfinder (Agent Skill) and scored it 96/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 1 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 1 flagged
The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Use this skill when the user asks you to find an MCP server, tool, skill, or agent for a task. It searches an ARD Agent Finder (a discovery service) and presents matches for the user to choose from.
Invoke it as /agentfinder <query>, where <query> is the task to find tools for. Also use it whenever the user otherwise asks you to find a tool, MCP server, or integration for a task. Search the registry when the task needs a third-party service (email, calendars, payments, databases, cloud, CI/CD, monitoring, messaging, file storage); skip it for purely local work (writing code, editing files, git, shell, math).
This skill already knows where to search — GitHub's Agent Finder:
https://agentfinder.github.com/api/v1/searchQuery it directly. Never ask the user for a URL — the endpoint is built in, so /agentfinder <task> works with zero configuration. No authentication is required.
Use a different service only if the user explicitly names one (e.g. Hugging Face Discover, or one from their agent-finders.json). If they give an ARD service base URL (a version root like https://host/api/v1), derive the endpoints from it: append /search to search, /mcp for its MCP endpoint.
Send the user's task as an ARD query object. Use whatever HTTP capability you have (in a terminal, curl):
curl -s https://agentfinder.github.com/api/v1/search \
-H 'Content-Type: application/json' \
-d '{"query":{"text":"<the user's task, in plain language>"}}'query object with a text field. Add anoptional query.filter (e.g. {"type":["application/mcp-server+json"]}) to narrow by resource type, and "pageSize": <n> to cap results.
The response is { "results": [ ... ] }. Each result has displayName, mediaType (the resource type, e.g. application/mcp-server+json), url, identifier, source, and a relevance score. Show a numbered list — for each: displayName, the type, the url, and the score. State that the score is relevance only — not a trust or safety rating.
Do not add, enable, connect, or install any returned resource yourself. Installation is always the user's explicit choice.
Once the user picks a result, show them how to add that resource using its url:
application/mcp-server+json — add it as an MCP server (a .vscode/mcp.jsonor claude_desktop_config.json entry, or your client's "add MCP server" flow), pointed at the resource's url.
application/ai-skill — install the skill from its url.url over its own protocol.Then stop and let the user act.
GitHub Copilot — copy this github-copilot/ folder into a directory Copilot scans: ~/.copilot/skills/ (personal) or .github/skills/ (project). Copilot also reads ~/.claude/skills/, so a copy there is picked up too.
cp -r connectors/skills/github-copilot ~/.copilot/skills/Then invoke /agentfinder <query>.
This skill defaults to GitHub's Agent Finder with no configuration. For a connector that asks which discovery service to use instead, see the generic agentfinder skill.~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.