Is mcp-scripts safe to install?

SaferSkills independently audited mcp-scripts (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.

CategoryWeightCategory scoreContribution

Securityprompt, exec, net, exfil, eval

35%

100

35.0 pts

Supply chainhash, typosquat, maintainer, lockfile

20%

100

20.0 pts

Maintenancestaleness, pinning, CI

15%

100

15.0 pts

TransparencySKILL.md, perms, README

15%

100

15.0 pts

Communityinstalls, verify, response

15%

100

15.0 pts

Findings & checks · 0 flagged

Securityscore 100 · 0 findings

✓—All security checks passedNo findings in this category for the latest scan.pass

Supply chainscore 100 · 0 findings

✓—All supply chain checks passedNo findings in this category for the latest scan.pass

Maintenancescore 100 · 0 findings

✓—All maintenance checks passedNo findings in this category for the latest scan.pass

Transparencyscore 100 · 0 findings

✓—All transparency checks passedNo findings in this category for the latest scan.pass

Communityscore 100 · 0 findings

✓—All community checks passedNo findings in this category for the latest scan.pass

The primary manifest — the file an agent reads to learn what this artifact does.

skills/mcp-scripts/SKILL.md · 1 file

skills/mcp-scripts/SKILL.md0.8 KB · Markdown

name: mcp-scripts

description: MCP Script Rules

user-invocable: false

MCP Script Rules

When working with files in scripts/:

DO

Use CLI arguments for all parameters (argparse)
Include USAGE docstring at top of file
Use call_mcp_tool("server__tool", params) pattern
Handle errors gracefully with informative messages
Print results to stdout for Claude to process

DON'T

Hardcode parameters in the script
Edit scripts to change parameters (use CLI args instead)
Import from servers/ directly (use runtime.mcp_client)

Tool Naming

Tool IDs use double underscore: serverName__toolName

Examples:

morph__warpgrep_codebase_search
ast-grep__ast_grep
perplexity__perplexity_ask

Testing

Test with: uv run python -m runtime.harness scripts/<script>.py --help

mcp-scripts— agent skill

Is mcp-scripts safe to install?

MCP Script Rules

DO

DON'T

Tool Naming

Testing

Audit the pieces. Scan the whole. Decide.