Is stata-setup safe to install?

SaferSkills independently audited stata-setup (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.

CategoryWeightCategory scoreContribution

Securityprompt, exec, net, exfil, eval

35%

100

35.0 pts

Supply chainhash, typosquat, maintainer, lockfile

20%

100

20.0 pts

Maintenancestaleness, pinning, CI

15%

100

15.0 pts

TransparencySKILL.md, perms, README

15%

100

15.0 pts

Communityinstalls, verify, response

15%

100

15.0 pts

Findings & checks · 0 flagged

Securityscore 100 · 0 findings

✓—All security checks passedNo findings in this category for the latest scan.pass

Supply chainscore 100 · 0 findings

✓—All supply chain checks passedNo findings in this category for the latest scan.pass

Maintenancescore 100 · 0 findings

✓—All maintenance checks passedNo findings in this category for the latest scan.pass

Transparencyscore 100 · 0 findings

✓—All transparency checks passedNo findings in this category for the latest scan.pass

Communityscore 100 · 0 findings

✓—All community checks passedNo findings in this category for the latest scan.pass

The primary manifest — the file an agent reads to learn what this artifact does.

plugin/skills/stata-setup/SKILL.md · 1 file

plugin/skills/stata-setup/SKILL.md2.0 KB · Markdown

name: stata-setup

description: Install, configure, update, or verify mcp-stata across Claude Code, Codex, Gemini CLI, Cursor, Windsurf, and VS Code. Activate when users ask to set up the Stata toolkit or troubleshoot the installation.

Setup and Verification

Use the shared installer and verification flow instead of hand-writing per-agent config unless the user explicitly asks for manual steps.

Preferred Install Commands

Project-shared install:

bash plugin/install.sh --scope project

Personal install:

bash plugin/install.sh --scope user

Specific agent:

bash plugin/install.sh --agent codex

Pin a version if a lab wants to:

bash plugin/install.sh --version 2.5.1

Offline/local source:

bash plugin/install.sh --local-source /path/to/mcp-stata

Live verification:

bash plugin/install.sh --verify

What the Installer Does

Uses the canonical server id mcp-stata
Writes project-scoped configs where the client supports them
Falls back to user-scoped config where project scope is not first-class
Installs Codex skills into the Codex skills directory
Installs the Gemini extension from plugin/gemini-extension.json
Registers shared ~/.agents/skills/mcp-stata symlinks for compatible agents
Supports latest-by-default installs and explicit version pinning

Verification Standard

When the user asks whether setup is complete, verify more than “the file exists”:

Stata discovery and edition
uv / uvx availability
package availability for reghdfe and gtools
graph-export readiness
log-path emission for command output
startup/profile behavior

If live verification is not possible on the current machine, state exactly what remains unverified.

Troubleshooting

If Stata is not discovered, tell the user to set STATA_PATH.
If a user-managed machine blocks temp files, logs, or graph export, use the stata-environment-diagnose skill.
If project-wide configs are undesirable, re-run with --scope user.

stata-setup— agent skill

Is stata-setup safe to install?

Setup and Verification

Preferred Install Commands

What the Installer Does

Verification Standard

Troubleshooting

Audit the pieces. Scan the whole. Decide.