start-session — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited start-session (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Bring the Molten-hosted Foundry world up and report its state. This is a thin orchestration skill: the mechanics (waking the sleeping VM and launching the world) are already baked into the bridge — do not re-implement them here. Any tool call triggers the bridge's cold-start path automatically.
The headless bridge (src/foundry.ts) handles two distinct cold states on its own, driven by .env config (MOLTEN_MAGIC_URL, MOLTEN_ADMIN_KEY, MOLTEN_WORLD_ID):
/setup and launchesMOLTEN_WORLD_ID (game.post({action:'launchWorld', ...})).
heavy dnd5e world, plus VM wake time on a fully cold box).
So you don't drive any of this manually. You just make one tool call and the bridge does the rest.
take ~30–60s (VM wake + ~25s world boot), then call mcp__foundry-molten5e__get-world-info. This single call wakes + launches as needed and returns once the world is live. (If the world was already up, it returns immediately.)
+ version, Foundry version, and active users (confirm the MCP-Claude GM bridge user is present, which doubles as a bridge-health check).
to do, also call mcp__foundry-molten5e__get-current-scene and mention the active scene. Keep this brief — don't enumerate the whole world unprompted.
the user already stated the next task in the same message.
get-world-info failing almost always means the bridge couldn't reach or boot the box — it is not a reason to start clicking around. Diagnose in this order:
retry the same call once before concluding anything.
.env hasMOLTEN_MAGIC_URL, MOLTEN_ADMIN_KEY, and MOLTEN_WORLD_ID set (check names only, never echo secret values). If they're missing, that's why auto-launch didn't fire; tell the user, and offer the manual fallback: open the Magic URL in a browser to wake the VM, then launch the world from Foundry's /setup page.
broken. Report it plainly with the error; don't keep retrying in a loop.
delete world content as part of "starting a session."
user actually wants to do (or the relevant content skill, e.g. the planned Encounter Builder).
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.