Crewhu API Patterns — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited Crewhu API Patterns (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
The Crewhu MCP server exposes CSAT/NPS surveys, employee recognition (badges), and prize/redemption data for MSP teams. The tool surface is read-heavy — only crewhu_badges_update_contest performs writes.
Crewhu uses an API token passed via header:
| Header | Value |
|---|---|
X-Crewhu-Api-Token | The raw API token |
The gateway maps the environment variable X_CREWHU_APITOKEN onto the X-Crewhu-Api-Token header automatically.
export X_CREWHU_APITOKEN="your-crewhu-api-token"All 18 tools are exposed flat via tools/list — there is no navigation gating. Tool names follow crewhu_<domain>_<action> across four domains:
Only crewhu_badges_update_contest performs writes; everything else is read-only.
Crewhu list endpoints typically accept page/limit-style parameters. Always check whether more pages exist before claiming a result set is complete; for survey trend analysis, pull enough history to have a stable denominator.
| Status | Meaning | Action |
|---|---|---|
| 401 | Missing or invalid token | Re-check X_CREWHU_APITOKEN |
| 403 | Token valid but not authorized for this resource | Check token scope |
| 404 | Unknown survey / user / badge / prize ID | Re-list to confirm |
| 429 | Rate limit | Back off and retry |
crewhu_badges_update_contest mutates data; flag it explicitly before invoking.
(last 90 days minimum) to avoid sampling noise.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.