mcp-skill-vs-prompt-discovery-filtering-92b812 — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited mcp-skill-vs-prompt-discovery-filtering-92b812 (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Domain: tool-design Trigger: Apply when SkillTool enumerates commands to decide which slash commands should be available, ensuring MCP prompt skills are disambiguated from generic prompts. Source Pattern: Distilled from reviewed command discovery, MCP integration, and skill-surface implementations.
Inspect the MCP-discovered command surface, keep only entries that are actually prompt-based skills, and merge them with the local command registry into one unified list. Deduplicate by command name before validation or execution so MCP-discovered prompts cannot shadow or duplicate local skills by accident. Preserve source metadata so permission checks, telemetry, and UX can still tell whether a skill came from MCP or from a local registry.
cmd.type === 'prompt' before merging; prompts of other types should stay hidden because SkillTool only handles prompt-based skills.loadedFrom or other source identifiers so permission checks and telemetry can tell whether the skill came from MCP or local registries.If an MCP server exposes a prompt named changelog and the local registry already has one, run this filter before permission checks so the merged skill surface stays coherent and the MCP entry does not silently shadow the local one.
prompt commands without marking loadedFrom:'mcp', because telemetry and permission prompts rely on knowing which commands were discovered versus bundled.~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.